Enhancing Win2K Logon Security with Smart Cards

Be careful when you enter PINs. If you enter the wrong User PIN several times in a row, the smart card becomes locked. The only way you can unlock the card is to enter a valid Administrator PIN. If you enter the wrong Administrator PIN several times in a row, the smart card becomes permanently locked, which means you can't recover the smart card. Keep the Administrator PIN secret. You might consider using a range of Administrator PINs across batches of smart cards to improve security.

After a smart card has a certificate, the user can log on to any workstation that has an attached smart card reader. These workstations have a slightly different Welcome to Windows dialog box. The dialog box has a smart card reader icon and text that asks the user to insert the smart card into the reader or press Ctrl+ Alt+Del. If a user inserts a valid smart card into the reader, the Log on to Windows dialog box appears and asks the user to enter a PIN to unlock the card. After the card unlocks, the OS logs the user on to the system, assuming that the certificate in the smart card is valid. . . .