Problems with authentication on domain using smart card logon

Question

Problems with authentication on domain using smart card logon

Dragan Mišukić 11

Dear MS Support,

we're using Smart Card logon as second method of our users to sign into domain based PCs.

After latest Servicing Stack update (KB4586863) and Cumulative update (KB4586786), logon with smart card stopped working with this message: "This smart card could not be used. Additional detail may be available in the system log. Please report this error to your administrator".

We've done several things:

1) Deleted current Smart card driver and reinstalled it - Alcor Micro USB Smart Card reader - didn't helped

2) Tryed to uninstall specified updates using wusa.exe script in Command Prompt in elevated mode and in Power Shell and got reply: "Security Update for Microsoft Windows (KB4586863) is required by your computer and cannot be unninstaled".

3) Tryed to modifiy it using Local Group Policy Editor:

gpedit.smc (Run As Admin) / Computer Configuration / Administrative Templates / Windows Components /Smart Card

and enable feature: Turn on certificate propagation from smart card

Despite this troubleshooting, we haven't find any Microsoft related (TechNet or similar) link or blog where Event ID 5 (after we've searched Event Viewer) was described and resolution for this kind of error.

Endpoints whic experienced this kind of issue are Windows 10 PRO OS, versions 1909, 2004 and 20H2, latest builds.

Domain controllers are on Windows Server 2019 Standard OS version.

We have several PCs that haven't yet got those latests updates, and logon is working just fine on their PCs.

Please provide us help and navigate us what else can we troubleshoot further on since we're out of ideas.

Is the solution for this case to reset PC (installing clean OS version) or is there anything else we can do about this issue?

Thank you in advance for the provided help.

BR,

Dragan

Answer 1

Hi,
Thank you for posting in our forum. According to the situation you described and the corresponding solution you made, it seems that there is no problem, and the solution that our forum can provide is the same.
I may recommend you to seek the help of senior engineers, they can give you more in-depth and professional solutions
reference: https://support.microsoft.com/en-in/hub/4343728/support-for-business
Hope this information can help you
Best wishes
Vicky

Answer 2

Vicky Wang 2,611

Hi,

Just checking in to see if the information provided was helpful.

Please let us know if you would like further assistance.

Best Regards,
Vicky

Answer 3

Hey Dragan!

Did you get around this problem? I am sitting in the same situation, with this event id 5 blocking the logon using a smartcard. I also notice event id 1 and 2 (result 1326) deep down in the event log for Winlogon among the Windows operational logs.

I have tested Windows 1809 with all updates until yesterday(2021-02-18). All other prerequisites for my smart cards are in place. I have the external CA certitificate in both NTAuth and Root containers in AD, as well as a Certificate Revocation List available offline.

I have verified the chain using "certutil -scinfo".

Seems all MVPs from M$ are at a loss for this problem. I have been searching the net for solutions, but its like always, nonsense answers and then a support link.

Answer 4

Green and Relaxed 6

Just wanted to add my own comments, seeing the same thing as @Anders Haglund with a current up-to-date 20H2 (19042.804) Enterprise version. We're in the process of implementing smart cards and currently stuck, it cannot be a coincidence that we're stuck with the exact same error (even id 5 and event id 1+2 result 1326).

I really wish the the error message was a bit more informative.

I've verified that the third-party root CA is in fact applied to the computer, I can see the thumbprint under HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\EnterpriseCertificates\NTAuth\Certificates and that the CA is in fact under both computer and user certificate store in Trusted Root CA\Certificates. Also the domain has the CA applied.

Vadims Podāns 8,641 Reputation points MVP

2021-02-24T06:44:40.987+00:00

Is this root CA an issuer of smart card certificates or subordinate CA is an issuer?
Green and Relaxed 6 Reputation points

2021-02-24T08:55:49.007+00:00

the root CA is the issuer of our smart card certificates, the certificate path for the issued certificate is as follow:

root CA
.......I->org certificate
.............I->certificate issued to user

I even added the org certificate just to be sure, no dice.
Anders Haglund 1 Reputation point

2021-02-24T09:48:09.557+00:00

Hey Green,

I noticed Code Integrity(deep down in windows loga in event viewer) blocking my smartcard driver.

The driver is signed, so I am in the process of figuring out why lsass.exe couldnt load the dll.

I have NOT configured LSA protection (RunAsPPL), and I have been breaking my back to figure out Virtualization-based security. Seems having had the setting ”Enabled with UEFI lock” leaves things in the EFI partition, which means lowering the settings in GPO does not have an effect. However, a reinstall using MDT should give me a clean slate.
Vadims Podāns 8,641 Reputation points MVP

2021-02-24T10:54:50.773+00:00

Your root CA isn't an issuer of smart card certificates, so MUST NOT be presented in NTAuth DS store. Only org CA must be there. What errors you see in Event Log?
Green and Relaxed 6 Reputation points

2021-02-24T11:45:16.087+00:00

Nice catch! Found same/similar issue with dsminidrv.dll in CodeIntegrity. We're using Fujitsu mPollux DigiSign Client 4.1.4c and Alcor Micro USB Smart Card Reader with driver 1.9.6.1300.

We do have LSA protection on and have hardened our setup per:

Turn On Virtualization Based Security: Enable
Select Platform Security Level: Secure Boot
Virtualization Based Protection of Code Integrity: Enabled with UEFI lock
Require UEFI Memory Attributes Table Disabled
Credential Guard Configuration: Enabled with UEFI lock
Secure Launch Configuration: Enabled

I will do a test bed with a clean laptop with no GPOs other than a few select in order to try and narrow this problem down.
Anders Haglund 1 Reputation point

2021-02-24T12:51:37.43+00:00

For some reason, I cannot get Windows to stop crying about LSA. Having nothing in GPOs, no registry keys and even bcdedit in the /EFI/.. partition, the LSASS.exe still starts as protected with level 4. This is beyond frustrating.
Green and Relaxed 6 Reputation points

2021-02-24T13:13:15.103+00:00

I got the smart card logon to work but I had to enable legacy boot in BIOS and that turned off LSASS for good...

Not exactly an ideal situation but...
Green and Relaxed 6 Reputation points

2021-02-24T13:59:04.79+00:00

I removed the root ca and left the org ca, but the real fix was below. Turns out that for whatever reason LSA protection prevented the dll necessary from loading. No idea why this is and the only way to turn LSA off completely was to disable UEFI secure boot and enable legacy boot.
Anders Haglund 1 Reputation point

2021-02-24T14:02:00.203+00:00

A solution that is not really viable if you are worried about stuff like security. I cannot go that way sadly.

Seems LSA-plugins must be signed using a Microsoft certificate. Your troublesome dll is signed by the developer?
Green and Relaxed 6 Reputation points

2021-02-24T14:31:50.143+00:00

The root cause for this seems to be the fact (at least in my case) that the driver dsminidrv.dll is not WHQL signed. Therefore LSA protection prevents the dll from loading and this is the end result.

You can verify the driver signing status by going into device driver, clicking properties on the device in question, driver tab and clicking driver details. The Digital Signer should be "Microsoft Windows Hardware Compatibility" which would indicate that it is WHQL signed but in my case the signer is just software provider Fujitsu.

See "1. Signature verification" on https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/configuring-additional-lsa-protection
Green and Relaxed 6 Reputation points

2021-02-24T14:32:53.767+00:00

Correct, that seems to be the root cause of all of this. At least I now know who to contact to get this sorted.
Anders Haglund 1 Reputation point

2021-05-20T08:32:09.497+00:00

Hey Green!

Did you leave it at legacy? Sadly I had to pick this stinking ball up again.

I did however find event id 3033 in CodeIntegrity log deep in event viewer, or my colleage did.

Our solution use drivers NOT signed by Microsoft WHQL, and I have gathered that I need to somehow modify the CCI - Configurable Code Integrity.

My hope is that you, or someone reading this has an excellent source where I can read in detail exactly how this works and such.

Cheerio!

Problems with authentication on domain using smart card logon

4 answers

Activity