Smart Card Logon test is a failure

Hello, we are test user log-ins via the authentication by smart card on a closed network and we have had no success in connecting with our cards to chip on test stations.  We received an external domain domain controller certificates, as well as two root CA certificates and two intermediate certificates.  The workstations to output an error: "the system could not log.  "You cannot use a smart card to log smart card log on is not supported for your user account (Windows 7)" or "the system could not log.  The authentication server you reported and error (0xC00000BB).  You can find more information in the event log.  Report this error to the administrator of the system (Windows XP)".  There is no error useful to examine logs of the events of the workstation.

On domain controllers, the following errors appear in the system log:

EVENT ID: 19 Source: Kerberos-Key-Distribution-Center, this event indicates an attempt was made to use smart card logon, but the KDC is unable to use the PKINIT protocol because it lacks an appropriate certificate

EVENT ID: 29 Source: Kerberos Key Distribution Center The Key Distribution Center (KDC) could not find a suitable to be used for smart card logon, or the KDC certificate could not be verified.  Smart card logon may not work correctly if this problem is not resolved.  To correct this problem, check the existing KDC certificate by using certutil.exe, or sign up for a new KDC certificate.

Here is the question I have checked/verified so far:

(1) open ther Certificates.mmc a snap-in and verified software component (under the computer account) the certificate domain controller is located in the 'Personal' certificates, the root CA certificates are located in the "certificate authorities roots of trust", and the intermediaries/subordinate certificates are found with intermediate "CAS" folders

(2) the insured and default domain policy change certificates have been imported into their respective folders as well.  A ran a gpupdate/force on my workstation to test and verified that the policy works and certificates have been loaded.

(3) Ran certutil - store-Enterprise NTAuth and verified certificates have been published.

(4) copied the cert DC to my workstation and ran the following command prompt: certutil - verify - URLFetch DC.cer

The current result is:

Element.dwInfoStatus = CERT_TRUST_HAS_KEY_MATCH_ISSUER (0 x 2)

Element.dwInfoStatus = CERT_TRUST_HAS_PREFERRED_ISSUER (0x100)

Element.dwErrorStatus = CERT_TRUST_REVOCATION_STATUS_UNKNOWN (0x40)

Element.dwErrorStatus = CERT_TRUST_IS_OFFLINE_REVOCATION (0x10000000)

-----------------------------------Certificate AIA---------------------------------------

319.1654.0: 0x800072efd (WIN32: 12029): http://URL

Has no time "AIA": 0

Error recovery URL: error 0.80072efd (WIN32: 12029)

URL

-----------------------------------Certificate CDP---------------------------------------

Same message as above for AIA

ERROR: Verify revocation of certificate revocation function returned sheet status could not check revocation because the revocation server was offline.  0 x 80092013 (-2146885613)

CertUtil: The revocation function could not check revocation because the revocation server was offline

(5) copied my user on the domain controller certificate and again ran the following command against it: certutil - verify - URLFetch usercert.cer

(6) from my normal user account, I am able to verify that the CDP URL are correct and that it can download revocation lists.

I hope I have provided enough detail.  My colleagues and I are confused as to what is to prevent revocation checks and out to the CDP URLS that are valid, ultimately preventing us to connect with our cards smart.  Has anyone ever encountered this problem?  Your help is appreciated in advance.

You question may be better resolved if you post on the IT Pro Forum: http://social.technet.microsoft.com/Forums/windows/en-US/home?forum=w7itproinstall

J W Stuart: http://www.pagestart.com

Tags: Windows

Similar Questions

  • Users cannot use a smart card to log on a Server Terminal Services session on a computer that is running Windows Server 2008 R2 with SP1

    We have a Windows Server 2008 R2 with Sp1. There was the same exact problem in Windows Server 2008 (KB958596).

    When you use RDP or ICA (Citrix XenApp 6), smart card login prompt at random does not appear. When we close the RDP or ICA and make a new session of the guest of the smart card is here.

    Where can we get a fix, or a reg fix?

    Hotfix for Windows Server 2008 below...

    http://support.Microsoft.com/kb/958596

    In this scenario, users are unable to connect with their card chip and instead, he is invited for their usernames and passwords. If users don't provide these details, the Terminal Services session times out and disconnects.

    When this problem occurs, the option of smart card logon does not appear in the Terminal Services session. Users cannot connect by using their secret codes, and they must provide a user name and password. The option of smart card logon working again after that that they reconnect to the Terminal Services session one or more times

    Hello y2000max,

    Your windows server is beyond the scope of what is generally answered in these forums of consumers. I would recommend reposting among our public IT to Technet-Windows Server securityprofessionals. Thank you!

  • smart card reader has stopped responding on my hp Pavilion

    Help, please

    Hi Albert,

    Download and install the hotfix from the link below and see if it helps.

    A computer that has compatible smart card logon stops responding after that you remove and then re-insert a smart card in Windows 7, Windows Vista, Windows Server 2008 or Windows Server 2008 R2

    Good day!

    Just reply to us if you have any questions.

  • Connection of vSphere web customer smart card

    Smart card logon can be enabled on the web client of Vsphere?  I use 5.5

    I've looked everywhere and cannot find any info.

    Thank you

    The only option for smart card that my knowledge is that which is supposed to come with vSphere 6.0. It is however for US Federal customers only. (see http://www.vmware.com/files/pdf/vsphere/VMware-vSphere-Platform-Whats-New.pdf)

    in the document:

    DCUI smart card authentication

    This feature is for US Federal customers only. It allows access of DCUI connection using a common access card (CAC) and verification of personal identity (VIP). An ESXi host must belong to an Active Directory domain.

    André

  • failure of the targeted reading test and smart short self-test

    I have over problems with my computer is - it related to software or hardware?

    Please advice

    • The purpose of S.M.A.R.T. is to warn a user of imminent drive failure while there is still time to take action, such as copying the data to a replacement unit.

    The above is an excerpt from the article below:

    S.M.A.R.T.
     http://en.wikipedia.org/wiki/S.M.A.R.T.

    The thread below from Windows SevenForums describes possible solutions:

    Windows 7 - SMART short self-test fail
     http://www.SevenForums.com/hardware-devices/148900-smart-short-self-test-fail.html

    I strongly suggest you to immediately perform a backup of all your personal files, data, and anything else that is important for you to external media (an external IMO is better but you can also use CD/DVD or a USB flash drive) until the hard drive breaks down.

    Kind regards

  • Smart card certificate number

    Hello

    We use Gemalto ID smart cards first .net to open a session in our office systems and use the same to work from home, connecting via Citrix Online site.

    Lenovo laptop at home is able to install the card reader and the smart card. A copy of the certificate of the smart card is copied to the Windows 8.1 point certmgr. However, when you access our website, IE does not read the certificate.

    Our website accepts the connection via IE, Chrome and Firefox. All 3 browsers are unable to read the certificate and there is no prompt to choose the certificate also.

    This has been noted on all laptops Lenovo only. No problem when using other brands with the same operating system.

    Details of the laptop

    Model tested: Lenovo Z50-70

    OS: windows 8.1

    Used browsers: IE 11, Chrome and Firefox (latest versions)

    Smart Card: Gemalto IDEPrime .net card

    Only issue with different models of Lenovo laptops. Other brands with the same operating system and browsers works fine.

    Let me know if you need more details

    Thank you

    RAM.

    I reset my computer to factory settings and found the culprit.

    -DISCOVERY OF VISUAL SUPERFISH INC.

    Remove this program and your browser must Access your certificates with no problems.

    -Bryan

  • What are the answers of code of HD521-2W SMART short self-test error when running the diagnostics?

    1 HP Pavilion a4310f, product # AY014AA-ABA, software Build A1NAv6PrA1

    2. Microsoft Windows 7 Home Premium (64-bit) Edition

    3 a receipt the "Failed SMART short self-test HD521-2W" when executing Hardware Diagnostic tools.  Error message:

    Error message the device reported the following State: the previous self-test completed having the read element of the test failed. 01/12/2012-06:21:01

    The first LBA value failure Error Message is 440642933 and the failure occurred after that the device was working since 7943 hours under tension.

    01/12/2012-06:21:01

    4. I made no changes to my system for over a month.

    Device: Hard disk WDC WD64 00AAKS-65A7B SCSI Disk Device, the revision of the firmware 01.03B01

    This unit is my hard drive (it is in factory with partitions C: and D: {Factory Image})

    Hello

    The Smart error code would indicate that the hard disk is running out and must be replaced.  If you want a guide on this, let me know.

    Kind regards

    DP - K

  • 9-in-1 smart card reader fails to detect the SD card

    The9-1 Card Reader 5069-6732 in my Pavilion a604x has recently started not detect SD (non-SDHC) card when it is inserted into the slot. However, SD cards are detected in other PCs and their respective devices (cameras) and the USB port, which is part of the drive functions normally, just like the other USB ports.

    I would appreciate any suggestions you may have about this problem more far.

    The troubleshooting steps taken so far are:

    • confirmed the Device Manager detects the drive, the most up-to-date driver is installed and no errors have been found
    • uninstalled the SD Reader USB Device in device drives Manager, then rebooted and it helped to reinstall
    • confirmed Card Services smart Windows runs in msconfig and is set to Automatic Startup Type
    • restored the system to a date 3 months ago (well before the problem started)
    • Reload the default BIOS
    • Removed the drive and cleaned and inspected the pins, double checked cable connections

    I'm unable to test other types of smart cards that are not available to me at the moment.

    Right now I'm leaning to buying another drive asuming the former one was defective, but wanted to make sure I'm not overlooking what that it be before I take this measure.

    Thanks for your help

    Solved!  Replaced the card reader... now works as expected

  • How to disable the "Insert smart card" dialog box keeps appearing after the connection?

    Running Windows 7 64 bit on a laptop Dell which includes and integrated smart card reader. My configuration does not require a smart card to log on. I was wondering if the smart card reader has worked, I plugged a card chip used on another system. The driver is installed automatically, so it appears the drive works.

    Now, whenever I log in, the "Insert smart card" dialog box is displayed. If I cancel or close the box, he continues to reappear every few seconds. How to disable this behavior?

    Update: this is somehow connected to Outlook 2003. I have 4 different e-mail accounts. The "Insert smart card" box appears only when checking for my att account (yahoo), which is configured by using POP3.

    Go to the Services.msc and check the settings for the smartcard (manual test) service.

    Tom

    PS 29 December 2011

    The position of the OP, have been reported since a lot of this problem on the some notebooks Dell and HP. There are a few reports that a replacement of the motherboard fixed the problem and the other that the relocation of a certain connector (no mention of exaclly one that) solves the problem. Direct contact with the manufacturer of the laptop computer, Dell or HP wether, might be useful. Try a follow-up if you have already made contact.

    Tom

  • BlackBerry curve 8520 locked to smart card authentication. The phone says PIN does not and is not true.

    Hi all
    I have a big problem. I'm testing my smart card pilot in a BB 8520 curve. If someone wants to work with the BlackBerry Smart Card Reader and smart card a not suported must implement a smart card driver. And wthat I did.

    Everything works fine until it played some erroneous password settings results in the block of the card, and obviously I can not unlock the phone. I have

    The problem is that, although I've unlocked the map etc now the phone still saying that the pin code of the card is wrong. I'm sure I'm in the well axis and the problem is not on the driver code. It's as if the phone has been collapsed and always says that the spindle is bad.

    I tried many things and nothing works. I reset the phone, I deleted all the data, I reinstalled the software, everything, but I still get the locked phone.

    I guess this could solve by modifying the COMPUTER policies for passwords or something like that. I don't know, I'm not just a BlackBerry user. I only do it for work.

    I'm desperate. Could someone help me? Any value idea for me. I have a backup of everything, so I don't worry about what was the solution.

    If you think that you should put this post in another part, please let me know.

    Is attached a picture to show exactly what is happening to me. The DIF is on the PIN to the chip card. The other password its ok.

    Thank you.

    OK, I solved the problem.

    I made a backbup, then I did a factory reset password bad presentation 10 times, and I have restored the backup.

    I know that he's not a nice solution, but in my case was salvation!

  • The hardware diagnostic tool advises that the SMART short self-test has failed.

    The hardware diagnostic tool advises that the SMART short self-test has failed.

    Is this a problem? What can I do about it?

    Atelier42 wrote: the hardware diagnostic tool advises that SMART short self test failed.

    Is this a problem? What can I do about it?

    Hello Atelier42, this usually indicates that you have a hard disk failure.

    I would like to back up my data as soon as possible, just in case the hard drive breaks down actually.

    You must also make sure that you have the HP Recovery restore set for your system recovery disc in case you do not want to replace the hard drive.

    With this restore HP Recovery disk set, you could replace a defective hard drive and use this disk set to your HP system back as it was when shipped. Then, you could put your data saved on your system.

  • SMART short Self Test Failed - (error code: WHD16-8NR)

    Hi all

    I had my XPS L520X for 4 years and 2 months. I've never had a problem with its operation until last week. Randomly, it restarted and came with the PCI Realtek issue when it restarts.

    To cut a very long story short Fault find it which is going on, I reinstalled the entire operating system, including formatting of the hard drive.

    The problem of the laptop different freeze/crash and reboot with erros while doing normal tasks has not been resolved.

    I have run the Dell support center software and it shows the auto SMART test failed with the following code (error code: WHD16-8NR).

    Event log:

    Dell Support Center log file
    March 17, 2016 16:53:55
    Overall result: failed

    -------------------------------------------------------------------------------------------------------------------------------------------
    ST9750420AS [ATA:0:0\\?\ide#diskst9750420as___0005dem1#4&34e0611c&0&0.0.0#{53f56307-b6bf-11d0-94f2-00a0c91efb8b]}
    -------------------------------------------------------------------------------------------------------------------------------------------

    Seller: Seagate
    Model number: ST9750420AS
    Serial number: 6WS100EG
    Firmware revision: 0005DEM1
    Size: 698,6 GB
    Rotation speed: 7200 RPM
    Cache size: 16 MB
    Temperature: 43 c
    Physical sector size: 4 KB
    Logical sector size: 512 B
    Count of logical sector: 1465149168
    Supported standards: ATA8-ACS, ATA/ATAPI-7, ATA/ATAPI-6, ATA/ATAPI-5
    Specification Version: Rev ATA8-ACS 4

    ----------------------------
    OS - C: [PARTITION:C\\.\C:\]
    ----------------------------

    File system: NTFS
    Volume serial number: 5087-8802
    Volume capacity: 679.00 GB
    Amount of free space: 568,63 GB
    Volume space used: 110,37 GB

    Test of the SMART State

    Test started - 17/03/2016 16:43:57
          
    Finished test:-17/03/2016 16:43:59
    Past

    Test of SMART thresholds

    Test started - 17/03/2016 16:43:59
          
    Finished test:-17/03/2016 16:44:01
    Past

    Targeted reading test

    Test started - 17/03/2016 16:44:01
          
    Finished test:-17/03/2016 16:44:05
    Past

    Try to search randomly

    Test started - 17/03/2016 16:44:05
          
    Finished test:-17/03/2016 16:44:54
    Past

    Funnel Seek Test

    Test started - 17/03/2016 16:44:54
          
    Finished test:-17/03/2016 16:46:14
    Past

    Short what SMART self-test

    Test started - 17/03/2016 16:46:14
          
    Error message:-17/03/2016 16:46:24
    The unit has reported the following State: the previous self-test completed having the read element of the test failed.
    Error message:-17/03/2016 16:46:25
    The first default LBA value is 121243744 and the failure occurred after that the device was working since 8792 hours under tension.
    Finished test:-17/03/2016 16:46:26
          Failed (error code: WHD16-8NR)

    Surface Scan Test

    Test started - 17/03/2016 16:46:26
          
    Finished test:-17/03/2016 16:47:25
    Past

    Surface Scan Test - 2

    Test started - 17/03/2016 16:47:25
          
    Finished test:-17/03/2016 16:48:58
    Past

    I also went in the BIOS BOOT MENU by pressing F12 at startup and ran diagnostics that seemed to have said everything going, however I saw a mistake, faliure in its process that was too fast for me to write the error.

    In a nutshell, my thought is that my hard drive has failed / is corrupted or is about to fail.

    My simple question is, do I need a new hard drive with the information I've provided?

    Thank you very much!

    To all those who read this topic:

    I rang Dell directly and they confirmed my hard drive needs to be replaced.

    8792 power over time, I think that its actually me good.

    Bravo and thanks for the reply ejn63

  • Authentication Manager + GemPlus smart card reader

    Hi all!

    I was reading about View Manager Auth integration with RSA SecurID. I did some tests and worked like a charm.

    But what I could use solution gemplus smart card to authenticate users?

    Thank you.

    Best,

    Eduardo.

    If you found this information useful, please consider awarding points to 'Correct' or 'useful '.

    Hi Eduardo,

    VMware View supports RSA SecurID auth method. 2 factor.

    It also supports the opening of session of smart card on the desktop with SSO from the client to the office.

    There is an information guide to smart card on the vmware Web site explaining that: http://www.google.de/url?sa=t&source=web&ct=res&cd=1&ved=0CBYQFjAA&url=http%3A%2F%2Fwww.vmware.com%2Ffiles%2Fpdf%2Fview_cert_authentication.pdf&rct=j&q=SmartcardVMwareView + guide & ei = Vx75S6XuGMuLOOeNxZUM & usg = AFQjCNGqupwPpQBH34PP2mFe3zv1yIGIaw & sig2 = NHQsN1XjYLXgaXIx_5xqoA

    Kind regards

    Christoph

    Don't forget to assign points if this answer was helpful for you.

    Blog:

    http://Communities.VMware.com/blogs/Dommermuth | http://www.thatsmyview.NET/

  • Generate public and private keys within the smart card

    Hi all

    I use this code to generate public and private keys within the smart card.

    KeyPair kp = new pair of keys (KeyPair.ALG_RSA_CRT, KeyBuilder.LENGTH_RSA_512);
    kp.genKeyPair ();
    PrivateKey prikey = kp.getPrivate ();
    PublicKey pubkey = kp.getPublic ();

    This code runs without error.

    I need to obtain the public key of the smart card. So I need to get the public key to a byte array.
    But I can't get these keys in array of bytes of plain text.

    The methods I can get for pubkey object are

    pubkey.clearKey ();
    pubkey. Equals (obj);
    pubkey.getSize ();
    pubkey.getType ();
    pubkey.isInitialized (); only these.

    I use
    Eclipse Version: 3.4.1 (level of agreement of the compiler = 1.4)
    Jcop plugin (to connect with the real map and to test the java code in virtual card provided by JCOP)
    OmniKey5321 (characters without contact) card reader

    What is the reason to get those above methods pubkey object? Is it a version problem?
    How can I get the public key in ordinary byte array? Is this possible?
    If it is not possible, is there a way to get the public key as a certificate of export or something another solution?

    If my script is not a possible strategy, how can I use private public keys to send the applet-specific data? Is there a better way to do it?

    Published by: 863766 on June 6, 2011 12:16 AM
    RSAPublicKey pubkey = kp.getPublic();
    

    then

    pubkey.getExponent(...); pubkey.getModulus(...);
    
  • The Authentucated smart card user session is stopped airtight when the card is removed, regardless of httpd SSLSessionCacheTimeout (default 300) setting. Why?

    I installed safety device in the option tab / advanced ff. Then using smart cards to connect to my server. The smart card user is authenticated and secure connection goes smoothly. When the card is removed from the card reader, the connection is immediately interrupted, regardless the SSLSessionCacheTimeout settings. Mine is set to 300.

    I did the same thing with IE, it maintains the connection until the expiry of the SSLSessionCacheTimeout.

    It is characteristic of FF-specific-designed? Or do I FF browser-specific sth keep my secure connection based on the parameter SSLSessionCacheTimeout?

    Thank you

    Hey SecureDevPaty,

    I wonder if you have installed a cert in the side server or client-side.

    I'm not an expert in the present, but these are the references that I found. I * think * after reading this session http://stackoverflow.com/questions/12.../session-disconnect-the-client-after-smart-card-is-removed LAA there is a feature of ssl in the about: config page. If you are looking for ssl, look at the features of trading. who, after having reread the thread we already did.

    I started to read more about the rules of ssl

    and a few rfcs. My question is, the rule for timeout, is this set on the server? with a specific rule in the cert? If it is a basis of cert, I would ask stackoverflow.com

Maybe you are looking for