How to lock Windows immediately upon smart card removal

Mon, Jul 01, 2013 at 8:35PM

I was previously unable to get this to work since I didn't know Microsoft Windows has 2 features that must be enabled, and I only enabled one of them.  The follow settings should allow locking your workstation upon removal of the smart card on the following operating systems: Windows Vista, Windows 7, Windows 8, Windows Server 2008, Windows Server 2008 R2 and WIndows Server 2012

Setting #1:  Run "gpedit.msc" as an administrator.

Navigate to this option group:
Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options

Set "Interactive logon: Smart card removal behavior" to "Lock Workstation".

Setting #2: Run "services" as an administrator

Right click on "Smart Card Removal Policy", and click property.  Set "Startup type" to "Automatic (delayed)".

The reason I used the "delayed" option instead of Automatic is that if the smart card software isn't fully loaded after the initial login, it might lock your computer immediately. My driver/smart card take a few seconds to be read so this fixed that problem for me so I only have to login once.

Hope this helps people who get stuck trying to figure this out.

External Resources:

Smart Card Removal Policy Service

Smart Card Removal Behavior

Bookmark & Share