Why is remote SmartCard not found when using RDP

remote desktopsmartcardvb6

I'm using Windows Server 2008 R2 which runs a VB6.0 application that uses a smartcard locally.

I then connect to this machine remotely using Remote Desktop Connection (6.3). However now the application shows the following error (SmartCard):

0x8010001d The Smart card resource manager is not running.

Research so far –

I don't wan't to use redirection as the card is on the remote machine already.
Using RDP the way I am trying to use it for is wrong and tightVNC is more appropriate (This does fix the issue)
Unsure – SCardEstablishContext API is returning that error because it gets an Access Denied error when trying to open an event called "Global\Microsoft Smart Card Resource Manager Started" with OpenEvent API. The default security for that event on Vista and Windows 7 specifies that only SYSTEM, LOCAL SERVICE and INTERACTIVE users have access to it. NETWORK SERVICE or non-interactive users won’t be able to access the event.

Why is the SmartCard not being recognised?

Any Information would be appreciated.

NOTE: The smartcard works fine when the application is on Windows Server 2008 R2 – however only fails when connecting remotely.

Best Answer

Before you create your Remote Desktop session, click on "Show options". Under the "Local Resources" tab there is a "Local devices and resources" panel. Click the "More" button.

Click on "Smart Cards". No complete the remote desktop session.

Related Solutions

C# – How to read credentials from a SmartCard in c#

Well if developing under windows, once you insert smart card windows will fetch all certificates from the smart card place them to the My certificate store.

var smartCardCerts = new List<X509Certificate2>();
var myStore = new X509Store(StoreName.My, StoreLocation.CurrentUser);
myStore.Open(OpenFlags.ReadOnly);
foreach(X509Certificate2 cert in myStore.Certificates)
{
  if( !cert.HasPrivateKey ) continue; // not smartcard for sure
  var rsa = cert.PrivateKey as RSACryptoServiceProvider;
  if( rsa==null ) continue; // not smart card cert again
  if( rsa.CspKeyContainerInfo.HardwareDevice ) // sure - smartcard
  {
     // inspect rsa.CspKeyContainerInfo.KeyContainerName Property
     // or rsa.CspKeyContainerInfo.ProviderName (your smartcard provider, such as 
     // "Schlumberger Cryptographic Service Provider" for Schlumberger Cryptoflex 4K
     // card, etc
     var name = cert.Name;
     rsa.SignData(); // to confirm presence of private key - to finally authenticate
  }
}

basically a lot of crypto API is available via .NET nowdays. But you could also use API directly Crypto API

for example you could access smart card directly via

CryptAcquireContext(&hProv,"\\.\<Reader Name>\<Container Name>",...)

where reader name is card reader name and container name is whatever rsa.KeyContainerName in code snippet above. There are multiple ways to access information like that and Crypto API is not very consistent or straightforward. as a hint .NET version of CryptAcquireContext is RSACryptoServiceProvider with CspParameters where you can specify container name if needed.

Well finding user in ActiveDirectory may be done via System.DirectoryServices.DirectoyEntry and System.DirectoryServices.DirectorySearcher, but do not forget System.DirectoryServices.ActiveDirectory.Forest and related API which makes some things a lot easier to figure out.

You would be able to get

How to Access Remote USB Smartcard during RDP

Use windbg from the Windows SDK debug tools. The function you are looking for is InTSRedirectModeWithContext.

Also this might help: http://lifayk.blogspot.ro/2012/07/windows-smart-card-subsystem-and-remote.html

Related Topic