Windows 10: Windows 11 24H2 Smart Card PIV with ECC Certificates

My company utilizes Yubikey smart cards with ECC Certificates from AD CS. Pre-24H2, we had no issues with signing in on/off-net, SSO, etc. for two years Win 10 or 11. Post W11 24H2, smart card users can not log into their devices off-net. Even while On-Net, the users token for MFA is non-existent. A user is prompted via MFA for every Microsoft Application when first run after logging in. A reboot forces MFA again. This effects four different manufacturers with Intel 13th Gen+ No AMD W11 24H2. I have done the following:All drivers / firmware / BIOS updatedCleared / reset TPMRefreshed P

:)

 

PIV Smart Card Reader

Hi All,

I am running Windows 10 Pro 64bit 1909 and 2004.
I am tasked with trying to figure out how to a PIV Reader on my physical PC and then VPN\remote into another network PC , and have that PIV Card reader be functional on the remote session.

I have gone into remote desktop connection and check smart cards, also ports and it doesn't work.
I need the PIV reader to show up, so I can insert the PIV card and gain access to a resource on another network.
I can do it, if I go to the remote PC Physically but that is not in the plans to go there everyday.

Any ideas?
Most articles I read I have not found anything relevant.

I found this, do you all think this would work
Share USB smart card reader over Ethernet

or do you think this is not possible , and a security issue , therefore Microsoft does not allow it.

 

Certificate based smart card logon to Windows 10/11 with FIPS certified smart card

Hi Zhou,

Thank you very much for your response.

I have already migrated my Root CA and smart card certificate to use SHA256, and my Windows 10/11 are latest version. But the Kerberos/PKINIT still use SHA1 instead of SHA2.

From version 8 to version 16 of [MS-PKCA]: Public Key Cryptography for Initial Authentication (PKINIT) in Kerberos Protocol we can find that SHA1 can be used with ECC and RSA, but SHA2 can only be used with ECC. Does that mean we should use ECC certificate?

Best Regards,

Geoffrey

 

Smart Card Certificates in Win10AU


I frequently access work sites that require me to use a CAC/PIV card. Some sites require my encryption certificate but OWA requires my email certificate. Prior to Win10AU update both my certs displayed but now I have to click show more to see all my certs. It's minor but annoying change with Win10AU. Microsoft if you read this please change it.