Vista - Smart Card - DOD CAC not working in VISTA

Hi,

I am testing an upgrade to Vista and have issues with smartcard. I did a
clean install of Vista and installed the smart card drivers for xp without
any problem but when I try to insert the smart card nothing happens. Device
manager reports that the smart card driver is ok and the device is working
properly. I also checked the services and they come up with no problems.

I also try installing the base version of XP, installing the drivers for the
smart card and then do an upgrade to Vista. During the upgrade, the
compatibility program did not complain about smart card drivers/software but
after the upgrade the same thing that smart card application did not respond
to the smart card insertion.

If someone has a work around/ fix for this please share with us. Thanks so
much.

Smart Card Hardware: PCMCIA ACTIVECARD P/N ZFG-9812-AC
Here is the error in the event log:

- <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
- <System>
<Provider Name="Microsoft-Windows-Smartcard-Server"
Guid="{4FCBF664-A33A-4652-B436-9D558983D955}" EventSourceName="SCardSvr" />
<EventID Qualifiers="0">610</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>0</Task>
<Opcode>0</Opcode>
<Keywords>0x80000000000000</Keywords>
<TimeCreated SystemTime="2006-12-23T01:05:20.000Z" />
<EventRecordID>436</EventRecordID>
<Correlation />
<Execution ProcessID="0" ThreadID="0" />
<Channel>System</Channel>
<Computer>asimlen</Computer>
<Security />
</System>
- <EventData>
<Data Name="Message">The device does not recognize the command.</Data>
<Data Name="Reader">SCM Microsystems SCR120 0</Data>
<Data Name="IOCTL">POWER</Data>
</EventData>
</Event>

What about contacting the manufacturer and/or vendor about
software drivers for Vista? That's probably the most
expedient way to get answers and/or the needed software.
Microsoft does not publish the software for the card readers!



Asim wrote:
> Hi,
>
> I am testing an upgrade to Vista and have issues with smartcard. I did a
> clean install of Vista and installed the smart card drivers for xp without
> any problem but when I try to insert the smart card nothing happens. Device
> manager reports that the smart card driver is ok and the device is working
> properly. I also checked the services and they come up with no problems.
>
> I also try installing the base version of XP, installing the drivers for the
> smart card and then do an upgrade to Vista. During the upgrade, the
> compatibility program did not complain about smart card drivers/software but
> after the upgrade the same thing that smart card application did not respond
> to the smart card insertion.
>
> If someone has a work around/ fix for this please share with us. Thanks so
> much.
>
> Smart Card Hardware: PCMCIA ACTIVECARD P/N ZFG-9812-AC
> Here is the error in the event log:
>
> - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> - <System>
> <Provider Name="Microsoft-Windows-Smartcard-Server"
> Guid="{4FCBF664-A33A-4652-B436-9D558983D955}" EventSourceName="SCardSvr" />
> <EventID Qualifiers="0">610</EventID>
> <Version>0</Version>
> <Level>2</Level>
> <Task>0</Task>
> <Opcode>0</Opcode>
> <Keywords>0x80000000000000</Keywords>
> <TimeCreated SystemTime="2006-12-23T01:05:20.000Z" />
> <EventRecordID>436</EventRecordID>
> <Correlation />
> <Execution ProcessID="0" ThreadID="0" />
> <Channel>System</Channel>
> <Computer>asimlen</Computer>
> <Security />
> </System>
> - <EventData>
> <Data Name="Message">The device does not recognize the command.</Data>
> <Data Name="Reader">SCM Microsystems SCR120 0</Data>
> <Data Name="IOCTL">POWER</Data>
> </EventData>
> </Event>
>

Thanks for taking the time to write. I did try calling them. Here is my
situation:

As a DOD end user, they tell me to go to DOD support desk. DOD -NMCI (NMCI
is DOD's end user's outsourced services) is still on Windows 2000 so I expect
them to be on Vista in 2010.
When I try to call directly or to search the public knowledge base
(http://www.actividentity.com/en/serv...ledge_base.php) they
refuse to answer becuase I don't have a direct contract with them. So i
decided to post this message here hopping that someone may have figured out a
way around this issue in Vista. I understand that MS is not the author of hte
software and they only provide hardware drivers for the smart card but still
wanted to try my luck on this forum. Thanks again.

"Theo" wrote:

> What about contacting the manufacturer and/or vendor about
> software drivers for Vista? That's probably the most
> expedient way to get answers and/or the needed software.
> Microsoft does not publish the software for the card readers!
>
>
>
> Asim wrote:
> > Hi,
> >
> > I am testing an upgrade to Vista and have issues with smartcard. I did a
> > clean install of Vista and installed the smart card drivers for xp without
> > any problem but when I try to insert the smart card nothing happens. Device
> > manager reports that the smart card driver is ok and the device is working
> > properly. I also checked the services and they come up with no problems.
> >
> > I also try installing the base version of XP, installing the drivers for the
> > smart card and then do an upgrade to Vista. During the upgrade, the
> > compatibility program did not complain about smart card drivers/software but
> > after the upgrade the same thing that smart card application did not respond
> > to the smart card insertion.
> >
> > If someone has a work around/ fix for this please share with us. Thanks so
> > much.
> >
> > Smart Card Hardware: PCMCIA ACTIVECARD P/N ZFG-9812-AC
> > Here is the error in the event log:
> >
> > - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> > - <System>
> > <Provider Name="Microsoft-Windows-Smartcard-Server"
> > Guid="{4FCBF664-A33A-4652-B436-9D558983D955}" EventSourceName="SCardSvr" />
> > <EventID Qualifiers="0">610</EventID>
> > <Version>0</Version>
> > <Level>2</Level>
> > <Task>0</Task>
> > <Opcode>0</Opcode>
> > <Keywords>0x80000000000000</Keywords>
> > <TimeCreated SystemTime="2006-12-23T01:05:20.000Z" />
> > <EventRecordID>436</EventRecordID>
> > <Correlation />
> > <Execution ProcessID="0" ThreadID="0" />
> > <Channel>System</Channel>
> > <Computer>asimlen</Computer>
> > <Security />
> > </System>
> > - <EventData>
> > <Data Name="Message">The device does not recognize the command.</Data>
> > <Data Name="Reader">SCM Microsystems SCR120 0</Data>
> > <Data Name="IOCTL">POWER</Data>
> > </EventData>
> > </Event>
> >
>

Since this is a DOD situation you might be playing with fire
when you go outside the DOD authorized channels for
assistance with there security software.

I wouldn't touch this one with a 10-foot pole!!

Asim wrote:
> Thanks for taking the time to write. I did try calling them. Here is my
> situation:
>
> As a DOD end user, they tell me to go to DOD support desk. DOD -NMCI (NMCI
> is DOD's end user's outsourced services) is still on Windows 2000 so I expect
> them to be on Vista in 2010.
> When I try to call directly or to search the public knowledge base
> (http://www.actividentity.com/en/serv...ledge_base.php) they
> refuse to answer becuase I don't have a direct contract with them. So i
> decided to post this message here hopping that someone may have figured out a
> way around this issue in Vista. I understand that MS is not the author of hte
> software and they only provide hardware drivers for the smart card but still
> wanted to try my luck on this forum. Thanks again.
>
> "Theo" wrote:
>
>> What about contacting the manufacturer and/or vendor about
>> software drivers for Vista? That's probably the most
>> expedient way to get answers and/or the needed software.
>> Microsoft does not publish the software for the card readers!
>>
>>
>>
>> Asim wrote:
>>> Hi,
>>>
>>> I am testing an upgrade to Vista and have issues with smartcard. I did a
>>> clean install of Vista and installed the smart card drivers for xp without
>>> any problem but when I try to insert the smart card nothing happens. Device
>>> manager reports that the smart card driver is ok and the device is working
>>> properly. I also checked the services and they come up with no problems.
>>>
>>> I also try installing the base version of XP, installing the drivers for the
>>> smart card and then do an upgrade to Vista. During the upgrade, the
>>> compatibility program did not complain about smart card drivers/software but
>>> after the upgrade the same thing that smart card application did not respond
>>> to the smart card insertion.
>>>
>>> If someone has a work around/ fix for this please share with us. Thanks so
>>> much.
>>>
>>> Smart Card Hardware: PCMCIA ACTIVECARD P/N ZFG-9812-AC
>>> Here is the error in the event log:
>>>
>>> - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
>>> - <System>
>>> <Provider Name="Microsoft-Windows-Smartcard-Server"
>>> Guid="{4FCBF664-A33A-4652-B436-9D558983D955}" EventSourceName="SCardSvr" />
>>> <EventID Qualifiers="0">610</EventID>
>>> <Version>0</Version>
>>> <Level>2</Level>
>>> <Task>0</Task>
>>> <Opcode>0</Opcode>
>>> <Keywords>0x80000000000000</Keywords>
>>> <TimeCreated SystemTime="2006-12-23T01:05:20.000Z" />
>>> <EventRecordID>436</EventRecordID>
>>> <Correlation />
>>> <Execution ProcessID="0" ThreadID="0" />
>>> <Channel>System</Channel>
>>> <Computer>asimlen</Computer>
>>> <Security />
>>> </System>
>>> - <EventData>
>>> <Data Name="Message">The device does not recognize the command.</Data>
>>> <Data Name="Reader">SCM Microsystems SCR120 0</Data>
>>> <Data Name="IOCTL">POWER</Data>
>>> </EventData>
>>> </Event>
>>>

Thanks again for your advice.

For benifit of anyone else who is looking for this software: I found out
that ACTIVE CARD client version 6.0 for PKI is supported on XP/Vista. (DOD
just signed a contract and will soon provide ActivClient 6.0 for PKI. This
middleware will replace ActivCard 2.2, which enables personnel to use their
Common Access Card (CAC).
Complete announcement for those who can see is at infosec website.

Here is a link to the public story:
http://www.itnews.com.au/newsstory.aspx?CIaNID=41231

Thanks and Happy Holidays!

"Theo" wrote:

> Since this is a DOD situation you might be playing with fire
> when you go outside the DOD authorized channels for
> assistance with there security software.
>
> I wouldn't touch this one with a 10-foot pole!!
>
> Asim wrote:
> > Thanks for taking the time to write. I did try calling them. Here is my
> > situation:
> >
> > As a DOD end user, they tell me to go to DOD support desk. DOD -NMCI (NMCI
> > is DOD's end user's outsourced services) is still on Windows 2000 so I expect
> > them to be on Vista in 2010.
> > When I try to call directly or to search the public knowledge base
> > (http://www.actividentity.com/en/serv...ledge_base.php) they
> > refuse to answer becuase I don't have a direct contract with them. So i
> > decided to post this message here hopping that someone may have figured out a
> > way around this issue in Vista. I understand that MS is not the author of hte
> > software and they only provide hardware drivers for the smart card but still
> > wanted to try my luck on this forum. Thanks again.
> >
> > "Theo" wrote:
> >
> >> What about contacting the manufacturer and/or vendor about
> >> software drivers for Vista? That's probably the most
> >> expedient way to get answers and/or the needed software.
> >> Microsoft does not publish the software for the card readers!
> >>
> >>
> >>
> >> Asim wrote:
> >>> Hi,
> >>>
> >>> I am testing an upgrade to Vista and have issues with smartcard. I did a
> >>> clean install of Vista and installed the smart card drivers for xp without
> >>> any problem but when I try to insert the smart card nothing happens. Device
> >>> manager reports that the smart card driver is ok and the device is working
> >>> properly. I also checked the services and they come up with no problems.
> >>>
> >>> I also try installing the base version of XP, installing the drivers for the
> >>> smart card and then do an upgrade to Vista. During the upgrade, the
> >>> compatibility program did not complain about smart card drivers/software but
> >>> after the upgrade the same thing that smart card application did not respond
> >>> to the smart card insertion.
> >>>
> >>> If someone has a work around/ fix for this please share with us. Thanks so
> >>> much.
> >>>
> >>> Smart Card Hardware: PCMCIA ACTIVECARD P/N ZFG-9812-AC
> >>> Here is the error in the event log:
> >>>
> >>> - <Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
> >>> - <System>
> >>> <Provider Name="Microsoft-Windows-Smartcard-Server"
> >>> Guid="{4FCBF664-A33A-4652-B436-9D558983D955}" EventSourceName="SCardSvr" />
> >>> <EventID Qualifiers="0">610</EventID>
> >>> <Version>0</Version>
> >>> <Level>2</Level>
> >>> <Task>0</Task>
> >>> <Opcode>0</Opcode>
> >>> <Keywords>0x80000000000000</Keywords>
> >>> <TimeCreated SystemTime="2006-12-23T01:05:20.000Z" />
> >>> <EventRecordID>436</EventRecordID>
> >>> <Correlation />
> >>> <Execution ProcessID="0" ThreadID="0" />
> >>> <Channel>System</Channel>
> >>> <Computer>asimlen</Computer>
> >>> <Security />
> >>> </System>
> >>> - <EventData>
> >>> <Data Name="Message">The device does not recognize the command.</Data>
> >>> <Data Name="Reader">SCM Microsystems SCR120 0</Data>
> >>> <Data Name="IOCTL">POWER</Data>
> >>> </EventData>
> >>> </Event>
> >>>
>

My issue appears to be related. I am running Vista Ultimate 32bit and I have two card readers. One is an SCM 3340 that goes in the expresscard slot. The other is a USB 2.0 reader. Both work in other XP computers, but only the USB reader works in my Vista machine. The ActivClient software refuses to acknowledge that I have a smart card reader installed when I only have the SCM 3340 plugged in. Any thoughts?

I purchased the Dell XPS, with Vista, just a couple of weeks ago. I
downloaded the drivers for the CAC reader - all is working properly, as I can
see my certificate. But, Vista says that there's not enough information
about the issuer of the DoD CAC certificate for it to be verified by Vista.
I am running Windows XP on my desktop - CAC reader working perfectly. I have
never been connected to the government computer system with my desktop, a big
"NO NO" in the security world. However, XP recognizes, or allows the DoD
system, to see my certificate. It has to be some kind of security setting
within Vista. I have even had my IT guys looking at the situation - they are
stumped as well. Any guidance would be greatly appreciated.

"Queue" wrote:

Kat,

You didn't say whether you got the ExpressCard or the USB reader. I'm going to assume the USB since, to my knowledge, the ExpressCard will not work properly in Vista. As for your desktop connecting to the "government computer system", I'm going to make the assumption that you're talking about NMCI's network versus an RDT&E network. I'll have to assume that you're trying to connect this Vista machine to either RDT&E or some private network that has Internet access.

Given those assumptions, this sounds like you need to get the proper root certificates installed on your machine. NMCI support SHOULD be able to help you with this, but rather than spend forever on the phone with them and also risk their scorn for not doing things the NMCI way, I did a google search and found them hanging around. I don't remember where that was now, but here's a site I just found that appears to have installs for them:

Resources: Installing DoD Root Certificates

Other things you can try are listed below, and some of these things may help solve problems you haven't encountered yet.

You must be running ActivClient 6.1 or later and you have to go into the client and make your CAC certificates available to Windows.

You might also need to look closely at your security settings and make sure you allow certain scripting options, cookies, or some such. I don't remember having to really change anything there, but a coworker of mine had to add some option. I'll do some more checking on what that was if you have problems connecting to sites.

You can try adding https://webmail.nmci.navy.mil to your trusted sites list, but I found that just causes more prompts for me and didn't really make a difference.

Let me know how far you get. So far, everyone I work with that has Vista (only a few people) has managed to get both webmail and DTS to work as well as many of the other CAC enabled sites.

Queue

In your Internet Explorer 7 browser, you will need to go to: Tools, Internet Options, Security and click on the Internet Security option. Then uncheck the box for Enable Protected Mode. Doing this allowed me access to both DTS and AKO.

I did that at first too, but you don't have to. Instead of disabling protected mode for all your internet sites, just add the DTS site to the trusted site list. I didn't have to do that for NMCI E-Mail, and that was the one that caused problems when I did. But DTS works better if you add it to the trusted sites.