The Smartcard Removal Policy Service and VPN

  • Article

Microsoft Windows Server 2008 R2 Operating System

The ScPolicySvc service works by monitoring a specific registry key (See Deconstructing the Smartcard Removal Policy Service).

The VPN client (Connection Manager aka CM) on the other hand doesn’t use the Credential Provider architecture, it uses its own code for picking which certificate from the smartcard will be used for logon.

The VPN component not using CredUI or LogonUI has two side-effects:

  • The Smartcard Removal Policy Service doesn’t monitor logons made with the VPN client as the registry key isn’t touched when the VPN logon occurs
  • The user logging on doesn’t get to pick which smartcard certificate will be used for the VPN connection – the VPN components does a simple certificate selection and picks the smartcard logon certificate in the default container (usually the last certificate enrolled for).

How to Support Smart Card Logon for Remote Access VPN Connections
http://technet.microsoft.com/en-us/library/cc875840.aspx

Deconstructing the Smartcard Removal Policy Service:
http://blogs.technet.com/instan/archive/2010/03/08/deconstructing-the-smartcard-removal-service.aspx

Where Is “Logon Using Dial-Up Connections” in Windows Vista?
http://blogs.technet.com/grouppolicy/archive/2007/07/30/where-is-logon-using-dial-up-connections-in-windows-vista.aspx