Smart cards

Smart cards are a tamper-resistant and portable way to provide security solutions for tasks such as client authentication, logging on to a Microsoft® Windows® Server 2003 family domain, code signing and securing e-mail.

  • Before deploying smart cards, see Checklist: Deploying smart cards for logging on to Windows.
  • For help with specific tasks, see How To.
  • For general background information, see Concepts.


Checklist: Deploying smart cards for logging on to Windows

Step | Reference
Review concepts about smart cards. | Smart Card Concepts
Set up certification authorities (CAs) and the certification hierarchy |
If you have not already done so, follow the checklist for deploying certification authorities and public key infrastructure (PKI) on an intranet. | Checklist: Creating a certification hierarchy with an offline root certification authority
For each domain |
Set the security permissions of the Smart Card User, Smart Card Logon, and Enrollment Agent certificate templates to allow smart card users to enroll for certificates. | Allow subjects to request a certificate that is based on the template
For each certification authority issuing smart card certificates |
Set up the certification authority to issue smart card certificates. | Prepare a certification authority to issue smart card certificates
If you did not do so in the previous step, set up a certification authority to issue Enrollment Agent certificates. | Establish the certificate types an Enterprise certification authority can issue
Set up a smart card enrollment station |
Install a smart card reader. | Install a smart card reader on a computer
Get an Enrollment Agent certificate for the persons who will be setting up smart cards for users. | Prepare a smart card certificate enrollment station
For each smart card user |
Set up smart cards. | Set up a smart card for user logon
Install a smart card reader on the smart card user's computer. | Install a smart card reader on a computer
Review smart card logon procedure. | Log on to a computer with a smart card


How to...

Microsoft Windows graphic

How to ...

  • Install a smart card reader on a computer
  • Log on to a computer with a smart card
  • Administer smart cards


Install a smart card reader on a computer

Microsoft Windows graphic

To install a smart card reader on a computer

  1. Depending on the type of reader you have purchased, attach your reader to an available serial or USB port or insert the PC card reader into an available PCMCIA slot.
  2. If you connected a serial port reader, restart the computer to detect it and then log on to the computer.
  3. Do one of the following:
    • If the device driver for the smart card reader is available as part of Windows Server 2003 family, the installation of the driver takes place without any prompting by the user. This may take a few minutes.
    • If the device driver for the smart card reader is not available as part of Windows Server 2003 family, the Add Hardware Wizard starts. Follow the directions for installing the device driver software.

Important

  • Smart card readers generally come with setup instructions from the manufacturer. If your reader comes with instructions, you should use those. If not, then use these general procedures.

Notes

  • You can confirm that the installation was successful by confirming that the reader appears in the Device Manager tree.
  • If the smart card reader is not installed automatically or the Add Hardware Wizard does not start automatically, then your smart card reader may not be compliant with Plug and Play specifications. You should contact the smart card reader manufacturer for the device driver and the instructions on how to install and configure the device.
  • When using the Add Hardware Wizard to install a smart card reader, you need the device driver. Contact the manufacturer of the smart card reader. Alternatively, your administrator may provide the driver.

Related Topics


Log on to a computer with a smart card

Microsoft Windows graphic

To log on to a computer with a smart card

  1. At the Windows Server 2003 family logon screen, insert your smart card in the smart card reader.
  2. Type the personal identification number (PIN) for the smart card when prompted by your computer.

Notes

  • You must prepare the smart card by creating the appropriate credentials before using it to log on to the computer. For more information on preparing a smart card, see Related Topics.
  • If the PIN you enter is recognized as legitimate, this logs you on to the computer and to the Windows Server 2003 family domain, based on the permissions assigned to your user account by the domain administrator.
  • If you enter the incorrect PIN for a smart card several times in a row, you will be unable to log on to the computer using that smart card. The number of allowable invalid logon attempts before lockout occurs varies according to the smart card manufacturer. Contact your administrator for assistance.
  • If you insert the smart card backwards or upside down, the smart card reader will not work. However, you may be prompted for a PIN which will not work. Follow the directions for your specific model of card reader to understand which way to insert the smart card.
  • Smart card logon only works for computers that are joined to a domain.

Related Topics


Administer smart cards

  • Prepare a certification authority to issue smart card certificates
  • Prepare a smart card certificate enrollment station
  • Set up a smart card for user logon
  • Configure a smart card user to temporarily log on to the network without a smart card


Prepare a certification authority to issue smart card certificates

Microsoft Windows graphic

To prepare a certification authority to issue smart card certificates

  1. Confirm that the proper security permissions are set on the Smart Card Logon, Smart Card User, and Enrollment Agent certificate templates.
  2. Log on with administrator rights to the certification authority (CA) you will use to issue smart card certificates.
  3. Open Certification Authority.
  4. In the console tree, click Policy Settings.

    Where?

    • Certification Authority (Computer)
    • CA_Name
    • Policy Settings
  5. On the Action menu, point to New, and then click Certificate to Issue.
  6. Do one of the following:
    • If the CA will issue certificates that are only for logging on to Windows with smart cards, click the Smart Card Logon certificate template, and then click OK.
    • If the CA will issue certificates that can be used to log on to Windows with smart cards and other uses, click the Smart Card User certificate template, and then click OK.
  7. On the Action menu, point to New, and then click Certificate to Issue.
  8. Click the Enrollment Agent certificate template, and then click OK.

Notes

  • XOX
  • The security permission setting of a certificate template indicates who is allowed to request a certificate of that type.
  • The Enrollment Agent certificate does not have to be issued from the same certification authority (CA) that will issue certificates for smart cards, as takes place in this procedure, but the issuing CA for the Enrollment Agent certificate must be a trusted enterprise CA in the domain. In that case, make sure that there is an enterprise CA in your domain that is capable of issuing Enrollment Agent certificates. To do this, follow the above steps for the CA that will issue certificates that will be used for logging on to Windows with a smart card and other uses. Then follow the above steps to issue an enrollment agent certificate.
  • This procedure only applies to enterprise CAs.

Related Topics


Prepare a smart card certificate enrollment station

Microsoft Windows graphic

To prepare a smart card certificate enrollment station

  1. On the computer that you will use to set up smart cards, install a smart card reader, following the manufacturer's instructions.
  2. Log on as the user or administrator who will be installing certificates on smart cards.
  3. On the taskbar, click the Start button, click Run, type mmc, and then click OK.
  4. On the File menu, click Add/Remove Snap-in, and then click Add.
  5. In Snap-in, double-click Certificates. If you are logged on as a user, the Certificates snap-in automatically loads.
    • If you are logged on as an Administrator, click My user account, and then click Finish.
  6. Click Close and then click OK.
  7. Double-click Certificates - Current User.
  8. In the console tree, click Personal.

    Where?

    • Certificates - Current User
    • Personal
  9. On the Action menu, point to All Tasks, and then click Request New Certificate.
  10. In the Certificate Request Wizard, click the Enrollment Agent certificate template and type a friendly name and a description for the certificate.
  11. When prompted by the Certificate Request Wizard, click Install Certificate.

Notes

  • The Web enrollment station can also be used instead of the method described in this procedure. For more information, see Related Topics.
  • Before requesting smart card logon certificates for users, a smart card administrator must have an Enrollment Agent certificate available to generate smart card certificate requests on the behalf of others. That is the purpose of this procedure.
  • To perform this procedure, you must have the appropriate security permissions to administer the Enrollment Agent certificate template. See Related Topics for more information about Enrollment Agent certificates and enrolling for a smart card certificate.
  • The Enrollment Agent certificate can be installed on a smart card, if you want. In that case, you must use the smart card manufacturer's cryptographic service provider (CSP) when requesting the certificate. (Click the Advanced Options button in the Certificate Request Wizard to select a smart card CSP for the Enrollment Agent certificate.)
  • These tasks can be performed on any computer running XOX or a member of the Windows Server 2003 family that you want to use as a smart card certificate enrollment station.

Related Topics


Set up a smart card for user logon

Microsoft Windows graphic

To set up a smart card for user logon

  1. Log on as an enrollment agent for the domain where the user's account is located.
  2. Open Internet Explorer.
  3. In Address, type the address of the certification authority (CA) that issues smart card certificates, and then press ENTER.
  4. Click Request a certificate and then click advanced certificate request.
  5. Click Request a certificate for a smart card on behalf of another user using the smart card certificate enrollment station. If you are prompted to accept the smart card signing certificate, click Yes.
  6. On the Smart Card Certificate Enrollment Station Web page, in Certificate Template, do one of the following:
    • Click Smart Card Logon if you want to use the smart card for logging on to Windows only.
    • Click Smart Card User if you want to use the smart card for secure e-mail as well as logging on to Windows.
  7. In Certification Authority, click the name of the CA you want to issue the smart card certificate.
  8. In Cryptographic Service Provider, select the cryptographic service provider (CSP) of the smart card's manufacturer.
  9. In Administrator Signing Certificate, click the Enrollment Agent certificate that will sign the enrollment request.
  10. In User To Enroll, click Select User, select the appropriate user account, and then click Enroll.
  11. When prompted by the system, insert the smart card into the smart card reader on your computer, click OK, and then, when prompted by the system, enter the personal identification number (PIN) for the smart card.
  12. (Optional) If the smart card you are setting up has a previously installed certificate on it, a message appears, asking whether you want to replace the existing credentials on the card. Click Yes.
  13. After the certificate is installed on the smart card, the CA Web page will give you the option of viewing the certificate you just installed or beginning a new smart card certificate request.

Notes

  • XOX
  • In the first step, anyone in the domain who has an Enrollment Agent certificate and has security permissions to issue smart card certificates is considered an enrollment agent.
  • The address of the certification server is the name of the server followed by /Certsrv. For example, in order to connect to the CA on a server named SmartcardCA, you would connect to:

    http://SmartcardCA/Certsrv

    Be sure to use the name of the server that the CA is installed on, not the CA name itself. In many cases, these names will be different.

  • If you have no Enrollment Agent certificate available, see Related Topics.
  • Users that will be logging on to computers running the Windows 2000 operating system must have a smart card enrolled from a computer running Windows 2000. Users that will log on to computers running XOX or XOX can have a smart card enrolled from a computer running any of these operating systems.

Related Topics


Configure a smart card user to temporarily log on to the network without a smart card

Microsoft Windows Graphic

To configure a smart card user to temporarily log on to the network without a smart card

  1. Open Active Directory Users and Computers.
  2. In the console tree, do one of the following.
    • Click Users.

      Where?

      • Active Directory Users and Computers
      • Domain Node
      • Users
    • Click the folder that contains the user account that you want.
  3. Right-click the user account, and then click Properties.
  4. Click the Account tab.
  5. In the Account options list, do the following:
    • Clear the Smart card is required for interactive logon check box.
    • Select the User must change password at next logon check box.
  6. Right-click the user account, and then click Reset Password.
  7. Provide a new password for this user.
  8. Inform the user of the new password and that the password must be changed the next time he or she logs on to the network.

Notes

  • XOX
  • The User must change password at next logon option is not required for this procedure to work, but it ensures that only the user has the correct password.

Related Topics


Concepts

This section provides general information about smart cards:

  • Smart cards overview
  • Understanding smart cards
  • Using smart cards


Smart cards overview

Smart cards are a tamper-resistant and portable way to provide security solutions for tasks such as logging on to a Microsoft® Windows® Server 2003 family domain, client authentication, code signing, and securing e-mail.

Support for cryptographic smart cards is a key feature of the public key infrastructure (PKI) that Microsoft has integrated into XOX and the Windows Server 2003 family.

Smart cards provide:

  • Tamper-resistant storage for protecting private keys and other forms of personal information.
  • Isolation of security-critical computations involving authentication, digital signatures, and key exchange from other parts of the computer that do not have a "need to know." These operations are all performed on the smart card.
  • Portability of credentials and other private information between computers at work, home, or on the road.

For more information, see Understanding smart cards and Using smart cards.

For smart card administrative and user procedures, see How To.

For the smart card deployment checklist, see Checklist: Deploying smart cards for logging on to Windows.


Understanding smart cards

Logging on to a network with a smart card provides a strong form of authentication because it uses cryptography-based identification and proof of possession when authenticating a user to a domain.

For example, if a malicious person obtains a user's password, that person can assume the user's identity on the network simply through use of the password. Many people choose passwords they can remember easily, which makes passwords inherently weak and open to attack.

In the case of smart cards, that same malicious person would have to obtain both the user's smart card and the personal identification number (PIN) to impersonate the user. This combination is obviously more difficult to attack because an additional layer of information is needed to impersonate a user. An additional benefit is that, after a small number of unsuccessful PIN inputs occur consecutively, a smart card is locked, making a dictionary attack against a smart card extremely difficult. (Note that a PIN does not have to be a series of numbers; it can also use other alphanumeric characters.) Smart cards are also resistant to undetected attacks because the card needs to be obtained by the malicious person, which is relatively easy for a user to know about.

For more conceptual information, see Using smart cards.

For smart card administrative and user procedures, see How To.


Using smart cards

This section provides general information about using smart cards:

  • Smart card readers
  • Supported smart cards
  • Enrolling for a smart card certificate
  • Logging on to a computer with a smart card
  • Using smart cards with system tools


Smart card readers

It is strongly recommended that only smart card readers that have been tested by the Microsoft Windows Hardware Quality Labs and have obtained the Windows-compatible logo be installed on XOX and Windows Server 2003 family computers.

Smart card readers that are not Plug and Play-compliant are not recommended on computers running XOX or the Windows Server 2003 family. If you are using such a reader, then you must obtain installation instructions (including associated device driver software) directly from the manufacturer of the smart card reader. Microsoft neither supports nor recommends the use of non-Plug and Play smart card readers.

For instructions on installing smart card readers, refer to the manufacturer's materials that are provided with the reader, or see Install a smart card reader on a computer.

The following smart card readers are supported by XOX and Windows Server 2003 family. Their drivers are installed only upon detection of the corresponding Plug and Play smart card reader hardware.

Brand | Smart card reader | Interface | Device driver
American Express | GCR435 | USB | Grclass.sys
Bull | SmarTLP3 | Serial | Bulltlp3.sys
Compaq | Serial reader | Serial | grserial.sys
Gemplus | GCR410P | Serial | Grserial.sys
Gemplus | GPR400 | PCMCIA | Gpr400.sys
Gemplus | GemPC430 | USB | Grclass.sys
Hewlett Packard | ProtectTools | Serial | Scr111.sys
Litronic | 220P | Serial | Lit220p.sys
Schlumberger | Reflex 20 | PCMCIA | Pscr.sys
Schlumberger | Reflex 72 | Serial | Scmstcs.sys
Schlumberger | Reflex Lite | Serial | Scr111.sys
SCM Microsystems | SCR111 | Serial | Scr111.sys
SCM Microsystems | SCR200 | Serial | Scmstcs.sys
SCM Microsystems | SCR120 | PCMCIA | Pscr.sys
SCM Microsystems | SCR300 | USB | Stcusb.sys
Systemneeds | External | Serial | Scr111.sys
Omnikey AG | 2010 | Serial | Sccmn50m.sys
Omnikey AG | 2020 | USB | Sccmusbm.sys
Omnikey AG | 4000 | PCMCIA | Cmbp0wdm.sys


Supported smart cards

When you install XOX or the Windows Server 2003 family, support for the following smart cards is included in the default installation.

Manufacturer | Model
Gemplus | GemSAFE 4k
Gemplus | GemSAFE 8k
Infineon | SICRYPT v2
Schlumberger | Cryptoflex 4k
Schlumberger | Cryptoflex 8k
Schlumberger | Cyberflex Access 16k

You do not need to configure anything on the client or server to use either of these cards. Cryptographic smart cards can only be obtained directly from the respective companies and not from Microsoft Corporation.

While support for these cards is included in XOX and the Windows Server 2003 family, other RSA-based cryptographic smart cards will also work with XOX and the Windows Server 2003 family, provided the card vendor has developed a cryptographic service provider (CSP) for the card using CryptoAPI and the Smart Card Software Developer's Kit, which is available through Microsoft Developer's Network (MSDN).

Smart card personal identification numbers (PINs) can be changed anytime the CSP displays the private key PIN dialog box. PIN management is the responsibility of the card CSP and the user. XOX and the Windows Server 2003 family do not manage PINs. For PIN management tools and instructions, contact the smart card vendor.


Enrolling for a smart card certificate

A domain user cannot enroll for a Smart Card Logon certificate (which provides authentication) or a Smart Card User certificate (which provides authentication plus other uses of the smart card cryptography) unless a system administrator has granted the user access rights to the certificate template that is stored in Active Directory. Enrollment for a smart card certificate must be a controlled procedure, in the same manner that employee badges are controlled for purposes of identification and physical access.

The recommended method for enrolling users for smart card-based certificates and keys is through the smart card enrollment station that is integrated with Certificate Services in XOX and XOX.

When an enterprise certification authority (CA) is installed, the installation includes the Smart Card Enrollment station. This allows an administrator to act on behalf of a user to request and install a Smart Card Logon certificate or Smart Card User certificate on the user's smart card. Prior to using the Smart Card Enrollment station, the smart card issuer must have obtained a signing certificate based on the Enrollment Agent certificate template. The signing certificate signs the certificate request that is generated on behalf of the smart card recipient.

By default, only domain administrators are granted permission to request a certificate based on the Enrollment Agent template. A user other than a domain administrator can be granted permission to enroll for an Enrollment Agent certificate by means of Active Directory Sites and Services.

Important

  • Once someone has an Enrollment Agent certificate, they can enroll for a certificate and generate a smart card on behalf of anyone in the organization. The resulting smart card could then be used to log on to the network and impersonate the real user.

Because of the powerful capability of the Enrollment Agent certificate, it is strongly recommended that your organization maintain very strong security policies over who has one. A scenario to minimize risk of Enrollment Agent certificate misuse would be to have one subordinate CA with very tight administrative controls in your organization that is only used to issue Enrollment Agent certificates. Once the initial Enrollment Agent certificates have been issued, the administrator of the CA can disable the issuance of Enrollment Agent certificates until they are needed again. By restricting the administrators who can operate the CA service on the subordinate CA, the service can be kept online for the generation and distribution of certificate revocation lists (CRLs) if necessary. Other CAs in the hierarchy can still issue Enrollment Agent certificates if their policy settings are changed, but you can determine whether inappropriate Enrollment Agent certificates are issued by checking the Issued Certificates log for each CA regularly.

For information on how to change the security permissions for a certificate template, see Allow subjects to request a certificate that is based on the template.

The enrollment station does not provide any card personalization functions, such as creating a file structure or setting the personal identification number (PIN), because those are card-specific functions and can only be done using specialized software provided by the smart card manufacturer.

For instructions on enrolling users for smart card certificates, see Set up a smart card for user logon. Note that users that log on to computers running a Windows 2000 operating system must have a smart card enrolled from a computer running Windows 2000. Users that log on to computers running XOX or XOX can have a smart card enrolled from a computer running any of these operating systems.


Logging on to a computer with a smart card

To log on to a computer with a smart card, users do not need to type CTRL+ALT+DEL. They simply insert the smart card into the smart card reader, and the computer prompts them for their personal identification number (PIN) instead of their user name and password (and, if applicable, domain).

For smart card logon procedures, see To log on to a computer with a smart card. For a list of procedures to enable logging on with a smart card, see Checklist: Deploying smart cards for logging on to Windows.


Using smart cards with system tools

In previous versions of Windows, smart cards were primarily used for user logon. In XOX and the Windows Server 2003 family, smart cards can be used with a number of system tools.

For making network connections, the user interface feature for mapping network drives can now use smart cards. The corresponding command-line tool Net also has the ability to use smart cards to provide credentials. For more information about Net, see Net use. For more information about mapping network drives, see To assign a drive letter to a network computer or folder.

In a secure environment, administrators will log on with normal user accounts for most of their regular work. When administrative functions need to be performed, a separate user account's credentials must be used. This is easily achieved with the Runas command. Smart cards can be used to provide the credentials to the Runas command, providing further enhanced levels of security. For more information about Runas, see Runas.

Domain administrators may also use smart cards to store their credentials. One operation that requires very secure credentials is installing Active Directory. This operation can accept credentials supplied from smart cards as well as the traditional user name and password. For more information, see Using the Active Directory Installation Wizard.