Consider the following scenario:

1. In the Active Directory domain network, you issue a smart card certificate to a smart card.
2. You use the smart card to log on a Windows XP-based computer that has joined the domain.
3. You use a third-party tool to change the smart card PIN. You leave your smart card in the reader.

In this scenario, when the applications on your computer try to access network resources, the smart card is locked.

Note: This issue also occurs in Windows Vista and in Windows Server 2008. In Windows Vista and in Windows Server 2008, you receive the following notification:

Windows needs your current credentials Please lock this computer, then unlock it using your most recent password or smart card

When you enroll a certificate on a computer that is running Windows Vista or that is running Windows Server 2008, you are prompted to insert a smart card even though a smart card is already inserted. After you unplug your smart card and then plug it in again, the certificate enrollment process continues successfully.

However, if the smart card and the reader are integrated into one unit, you cannot unplug the smart card. For example, if you use a USB token device as a smart card, the certificate enrollment process does not continue even after you unplug and then plug in the USB token device. Therefore, the certificate enrollment fails.

Consider the following scenario:

• You have a computer that is running Windows Vista or Windows Server 2008.
• You try to log on to a Windows Server 2008-based terminal server by using smart card authentication.

In this scenario, the logon operation fails. Additionally, you receive a “0xC000040C” error message.

Note: The “0xC000040C” error code means that the revocation status of the domain controller certificate that is used for smart card authentication cannot be determined.

This issue occurs when the cached certificate revocation list (CRL) of the domain controller certificate on the client has expired.

Consider the following scenario. You connect a USB Chip/Smart Card Interface Devices (CCID) smart card reader to a Windows Vista-based computer through an external USB hub. Then, the USB hub is disconnected from the computer while an application is communicating with the smart card reader. In this scenario, the Smart Card Resource Manager may stop responding (hang).

After the Smart Card Resource Manager stops responding, you cannot stop the Smart Card Resource Manager by using Task Manager. Additionally, you cannot access the smart card reader even if the USB hub is plugged into the computer again. In this case, you have to restart the computer.

Note: This problem does not occur if the smart card reader is directly connected to the computer.

Consider the following scenario:

• Your computer is in a wireless network environment that uses Extensible Authentication Protocol-Transport Layer Security (EAP-TLS).
• You use SmartCard-only authentication for the wireless connection authentication.

In this scenario, when you log on to a Windows Vista-based client computer, you may receive the following error message in the toolbar:

Cannot connect to SSID: Please contact network administrator.

Note: In this message, the SSID placeholder represents the wireless network connection.

Therefore, you cannot connect to the wireless network. In this case, you must manually reconnect to the wireless network.

This problem does not occur when you log on to the computer for the first time. When you log on for the first time, you receive the following message:

Wireless Network Connection:

Please click here to select the certificate for the following network connection or other qualification information.

After you provide the correct information, you can successfully connect to the wireless network.

Note: This problem does not occur in Windows XP. In Windows XP, you are prompted to provide the related smart card information. Then, you can successfully connect to the wireless network.

On a Windows Vista-based computer, you use a smart card to log on to a Windows Server 2003 Terminal Server through a Remote Desktop Protocol (RDP) session. Then, you remove the smart card. In this scenario, you may receive the following message in the remote RDP session:

The card supplied was not recognized. Please check that the card is inserted correctly, and fits tightly.

When the issue occurs, the RDP session is locked as expected.

This problem occurs if the Interactive logon: Smart card removal behavior Group Policy setting is set to Lock Workstation, and this setting is applied to the Terminal Server.

Notes

• This problem only occurs on a Windows Server 2003 Terminal Server.
• This problem does not harm the computer. You can safely ignore this message.