You cannot logon using a smart card

Smart card logon fails with error You cannot use a smart card to log on because smart card logon isn't supported for your user account, which possibly indicates your domain controller does not have a valid certificate.

Follow these steps to request a new certificate:

  1. Log in to the domain controller
  2. Open the Run prompt and run mmc (if prompted to elevate permissions, select Yes)
  3. Click File > Add / Remove Snap-In...
  4. Select Certificates and click Add
  5. Select Computer account and click Next
  6. Select Local computer and click Finish
  7. Click OK
  8. In the tree view on the left, navigate to Certificates (Local Computer) > Personal > Certificates
  9. Click Action > All Tasks > Request New Certificate
  10. Click Next
  11. Select Domain Controller Authentication and click Next
  12. Click Finish

Updated 5 months ago


  • Table of Contents
    • Symptoms
    • Solution

The problem is that the domain specified in the authencation certificate is invalid or inaccessble. Open client certificate (in certificate manager), switch to Details tab and scroll down to Subject Alternative Names certificate extension. Check for User Principal Name. It contains logon user name and authoritative domain for your user account. Client workstation attempts to contact specified domain to validate your credentials and fails.


If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.


Yes, we did validated and i forgot to point out that when i connect the affected PC to corporate network its getting fixed automatically.

With an example below,

I work continously at remote via VPN, i lock my windows 10 laptop "windows key + L" then come back after an hour, and i see in the screen "the domain specificied is not available"

This may help for you to direct us

Issue still persists, it is directing to smard card certification error. We are still working with Microsoft

Tom-4843 answered Aug 18, '22 Tom-4843 published Aug 18, '22

Hi there,

i have the same issue here. Did you find a way to fix this ?
Thanks and Regards,
Tom

Hello @Studmuffin1134-8970,

Thank you for posting here.

First
Do you request certificate on DC? If no, we can request certificate on DCs using Kerberos Authentication certificate template
or Domain Controller Authentication certificate template.

1.Type certlm.msc on Search Bar and click Enter.
2.Expand Certificates (Local Computer), right-click Personal, click All Tasks, and then click Request New Certificate.
In the Request Certificates page select Domain Controller Authentication
3.Check if that works for you!

Second
Check if the CA root certificate are install on both DCs and PCs (Trusted Root Certification Authority).
1.Type certlm.msc on Search Bar and click Enter.
2.Expand Certificates (Local Computer), click Trusted Root Certification Authority\Certificates.

You cannot logon using a smart card

Here is a similar case we can refer.
Smartcard Logon not enabled
https://social.technet.microsoft.com/Forums/windowsserver/en-US/ee52cb8f-c3cd-437f-9fc8-6884dd335394/smartcard-logon-not-enabled?forum=winserversecurity

If is does not work above, please confirm information below:

1.How many accounts have such issue?
2.How many machines have such issue?

Thank you for your understanding.

Best Regards,
Daisy Zhou