Default to Smart Card Win10 Build 1607 about windows-secure-host-baseline HOT 4 CLOSED

Yes, ActivClient uses a different provider. BUT in my experience it still doesn't 100% fix the issue. It seems to be a problem that ActivClient, not Microsoft, needs to fix. VERY annoying issue. I hope it can be resolved soon.

from windows-secure-host-baseline.

Do you know what provider we should set the default credential to?

from windows-secure-host-baseline.

After you log into the system running ActivClient v7, check the LastLoggedOnProvider value under HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\LogonUI. That will be the provider GUID used by ActivClient. It should be {05A69B2E-F05A-426B-BB43-7895A67B1A56}. As I said, this provider has been hit or miss for us. I just read a response on this thread from August 2017 stating that disabling the unwanted providers may achieve the results we want (smart card always being the default). https://social.technet.microsoft.com/Forums/en-US/7cbc01cd-a7ba-4595-a9de-da4286b9530e/how-to-set-smart-card-as-default-login-provider-on-windows-10

UPDATE: I tested adding the Windows 10 PasswordProvider {60b78e88-ead8-445c-9cfd-0b87f74ea6cd} to the 'Exclude credential providers' policy. This had the intended result of Smart Card being the default, however username and password is completely removed. This would make it very difficult to log in with local credentials during troubleshooting. This would be the perfect solution if there were a way to do this while still having the ability to enable username/password in an emergency.

from windows-secure-host-baseline.

As far as I know, you can't set a default provider that will display on the screen. Windows' behavior was changed. Previous registry hacks don't work anymore. https://github.com/iadgov/Secure-Host-Baseline/tree/master/ActivClient#configuring-the-smart-card-credential-provider-as-the-default-logon-credential-provider contains information about this: Smart card logon will be the default logon prompt once a user has logged into the system at least one time using a smart card. If the Interactive Logon: Do not display last username Group Policy setting is enabled, then a username and password prompt will always be the default logon prompt (1,2). The Interactive logon: Require smart card Group Policy setting can be used to force the smart card credential provider to be the default logon prompt, but then only smart card logons are allowed.

from windows-secure-host-baseline.