Smart Cards - Windows Logon Help Required

[lhurst59]

Hi all,

Hopefully someone will be able to help out with my query.

Problem:

I'm having a new laptop delivered with a built in Smart Card reader, so I thought that setting up Windows Logon via a Smart Card would be a good idea! problem is that it's proving impossible to find anything that is clear and shows how to achieve this.

I know that there is software out there for such a task but they are aimed at business implementations. All i want to do is have a stand alone system that authenticates with a Smart Card.

Does anyone have any info on this subject? your help would be appreciated.

By the way, the laptop will be getting a Vista Business upgrade when its released.

regards

Luke.

 

[jrbarnett]

Smart cards contain a digital certificate to prove the cardholder's identity, and so require access to a certificate server for performing the initial enrolment and to check for valid certificates (if they are not descended from a well known root certificate authority such as Verisign).
This is why (with XP anyway) typically certificate based logon methods require a Windows domain.

Is it possible to do this with a local machine not on a domain? I'm not sure. You would need to enrol your card with the issuing certificate, and a Windows XP machine won't be able to run Windows certificate server. Whether there is a third party application that could fulfil this role I'm not sure.

Will it be possible to do this after the Vista upgrade has been installed? Again, I'm not sure and haven't had much chance to look at Vista.

John

 

[lhurst59]

Hi jrbarnett,

Thanks for the reply. I'll have to look into whether XP/Vista allows local machine certificate enrollment.

The main thing i'm trying to find out, is how a smart card is configured. whether it's by using third party software or if Windows itself has the functionality to program a card.

This subject certainly seems to be a fairly unexplored topic. Even the laptop vendor has little or no info on the subject!

Luke.

 

[jrbarnett]

From a Windows perspective, you need to look at Certificate services, but this needs a Windows 2000 or 2003 server, it won't run on an XP workstation. Although issuing and enrolling certificates for smart cards is one use for the technology, it is only a small part of the perspective.
Needless to say, other certificate authority software is available.

John