Unable to login with a smart card. Error: "signing in with a smart card is not supported for your account"

Question

Hello everyone,

I am writing to describe a problem I have trying to setup an Windows Domain environment for a Automation System. Normaly, in the past we did really basic Active Directry setup with policies regarding accounts, passwords, RDP, use of USB devices (just standard security stuff, no more of a Securit Level 1 system). Now we develop to more secure systems, and I have a problem with 3 workstations that are in this Windows Domain. Those 3 workstation (only htose 3) needs to be accesable only using a smart card logon. And I am failing.

What I did:

1. Installed Certificate Authority (on the primary DC) with default settings. I created Certificate template for Smart Card Logon, and issued it to the domain.
2. In AD users and objects, I selected one domain user (the same one for the smard card setup and use) and I applied the setting: "Smart Card is required for Interactive Logon"
3. Applied GPO for interactive logon on the 3 workstations: Require Windows Hellor for Business or smart card logon - Enabled; Smart card removal Behaviour - Force logoff; Require Domain Controller authentication to unlock workstation - Enabled
4. Installed smart card software on the 3 workstation. I requested and obtained a valid certificate for the smart card. I can look into the settings of the smart card software and I see the corect ceritifcate, with the proper details beeing attached to the card.

When I try to logon, I chose signin option, select smart card. And the Windows PC is reading the user (and certificate) on the smart card. It requests the PIN, I type the PIN and it gets validated, the system moves towards loging in screen. However, I get the following error: "smart card logon is not supported for you user account."

Just some extra details: If I try to login with that particullar user with the standard authentication procedure: user+password, it fails. The message is this user is required to smart card to login.

I need to specify that in work with CA and certificates I am at the begging so I may have made mistakes...I just cannot identify what mistakes I made.

Some ideeas or help would be much most welcomed, as we are on a deadline to deliver the system, and this smart card login is the only stopping point.

Alex

Answer 1

Hello,

Try to check KDC certificates.

Thks.