Virtual Smart Cards on Server Core 2016

Shaunm001 306

Trying to enable virtual smart card on Server Core 2016, but I don't have the tpmvscmgr.exe command available like I do on GUI Server 2016 installations. Is this not possible on Server Core?

Reason I'm trying to do virtual smart card is because the server will not give us an option to log in at the console using smart card authentication, our only option is password (see below).

When we log into the same server via remote desktop, it does allow us to use smart card authentication:

It's only at the console that smart card is not an option. If anyone has suggestions on how to allow regular smart card authentication at the console OR set up virtual smart card on Server Core, that would be great!

1 answer

Jenny Feng 14,151 Reputation points

2021-02-15T07:41:20.637+00:00

Hi,
You could refer to the following guide:
https://learn.microsoft.com/en-us/windows/security/identity-protection/virtual-smart-cards/virtual-smart-card-get-started

Hope above information can help you.

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Shaunm001 306 Reputation points

2021-02-15T15:16:44.097+00:00

Thanks, I already have everything set up and working for virtual smart cards, my problem is with Step 2 of that documentation (creating the virtual smart card using tpmvscmgr.exe). Tpmvscmgr.exe is not present in our System32 folder on Server Core installations, it is only present on GUI installations. There seem to be some limitations with smart cards and Server Core, I'm trying to figure out what those are but there is no documentation anywhere. I know it must work because we can log onto our Server Core machines using Smart Cards via Remote Desktop (see screenshots above) but for some reason this is not an option when sitting at the server console.

Shaunm001 306 Reputation points

2021-02-15T19:20:49.033+00:00

So I figured out why Virtual Smart cards are not an option, we don't have a TPM hardware module installed on this server. So we're left with our physical smart card solution that works everywhere except on this Server Core machine (and only at the console; logging in remotely does allow smart cards). I wouldn't think a TPM module would be required for a physical smart card, but maybe it is?

Jenny Feng 14,151 Reputation points

2021-02-16T09:08:17.777+00:00

Hi,
Yes.
Virtual smart cards emulate the functionality of physical smart cards, but they use the Trusted Platform Module (TPM) chip that is available on computers in many organizations, rather than requiring the use of a separate physical smart card and reader.

Shaunm001 306 Reputation points

2021-02-16T16:21:01.37+00:00

Thanks for confirming that...

So, do I need to do anything special on Server Core to use physical smart cards? Is anyone else out there using physical smart cards on Server Core? Did you have to do anything special to make it work, or did it just work out of the box?
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Virtual Smart Cards on Server Core 2016

1 answer

Your answer