Earlier quoted context omitted.
We use RDP + TS gateway over VPN which you have to auth your remote key before you can connect. That's 4 factor :)
How many times do you enter in the same credentials throughout the logging process?
Pain to remember, but it's definitely secure.