Since I couldn’t find an all-in-one guide anywhere out there, I’m going to write up a short post on how to enable smart card logon in a Microsoft Active Directory environment.<\/p>\n
It’s short since I’m a little bit lazy in documenting every step (these are mainly notes for myself), but if enough people request, I’ll expand this post to include more details.
\n
\nRequirements:
\n– Active Directory (Windows 2003 and up). You cannot have smartcard login without some sort of directory service – that defeats the purpose of PKI.
\n– Smart card, smart card reader, and its middleware \/ drivers installed wherever you will be logging into the domain.<\/p>\n
Phases:
\nI. Install Certificate Services on a server that is part of the domain, configure a root CA, enable the Smartcard Logon certificate template
\nII. Create an GPO that auto-enrolls domain machines so that all your domain machines get a certificate & can renew them automatically. Make sure computers and all domain controllers have a certificate.
\nIII. Logon to a domain machine, open Certificates snap-in for the current user, request new certificate, select “advanced options”, pick the CSP for your smartcard and complete the request.
\nIV. Test logins \ud83d\ude42<\/p>\n","protected":false},"excerpt":{"rendered":"
Since I couldn’t find an all-in-one guide anywhere out there, I’m going to write up a short post on how to enable smart card logon in a Microsoft Active Directory environment. It’s short since I’m a little bit lazy in documenting every step (these are mainly notes for myself), but if enough people request, I’ll […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[13,15],"tags":[55,60,56,58,59,57],"class_list":["post-72","post","type-post","status-publish","format-standard","hentry","category-it-security","category-tutorials","tag-active","tag-certificate","tag-directory","tag-logon","tag-pki","tag-smartcard"],"_links":{"self":[{"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/posts\/72","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/comments?post=72"}],"version-history":[{"count":4,"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/posts\/72\/revisions"}],"predecessor-version":[{"id":132,"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/posts\/72\/revisions\/132"}],"wp:attachment":[{"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/media?parent=72"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/categories?post=72"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/dmach.net\/blog\/wp-json\/wp\/v2\/tags?post=72"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}