1

I would like to set up a domain-joined computer for passwordless login with some low-privileged domain account that is specific to that computer. I've seen some blog posts that store the username and password in a registry key, but I also thought that a virtual smart card with no PIN would work just as well. Is it valid to provision a smart card with no PIN?

Since TPMs are almost always used as two-factor authentication, it is pretty unusual to even want to use a smart card without a PIN, but in this situation I am fine with 1 factor authentication.

closed as off-topic by Greg Askew, Ward, MadHatter, Katherine Villyard, mdpc Jul 11 '15 at 0:06

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions should demonstrate reasonable business information technology management practices. Questions that relate to unsupported hardware or software platforms or unmaintained environments may not be suitable for Server Fault - see the help center." – Greg Askew, Ward, MadHatter, Katherine Villyard, mdpc
If this question can be reworded to fit the rules in the help center, please edit the question.

  • What is your end goal? Smart cards without PINs are very unlikely to exist because it defeats the purpose of having one, especially one that is virtual and always connected. Are you looking for some sort of kiosk mode for the workstation? – bobmagoo Jul 1 '15 at 5:47
  • Yeah, something sort of like a kiosk: One account tied to one machine that any user with physical access can use without needing a password. Unlike a kiosk, though, the machine doesn't have that many local restrictions (e.g. users are allowed to install software). – 0xFE Jul 2 '15 at 3:42
  • Unfortunately, people here thinks your question isn't about servers. I would suggest to re-ask this on superuser.com, where it will have probably much better chance to survive. – peterh Jul 10 '15 at 14:21
1

It's still not entirely clear what you really want, but based on the clarification in the comments you're better off setting restrictions on when users can log into computers using something like logon hours. It sounds like you're more interested in preventing logins to the box after a certain point (like when the smart card is removed) rather than getting security benefits from the smartcard itself. Given that the logged in user will already have admin rights on the box, a smartcard isn't going to give any additional security assurances.

You might also consider automatically imaging this box on some schedule (nightly, weekly, etc) to wipe out whatever malware or badness is likely to wind up on it.

  • My main goal is to not require the users to enter a password to access this computer. No time restrictions are necessary, which is why I was thinking a virtual smart card. – 0xFE Jul 8 '15 at 6:09

Not the answer you're looking for? Browse other questions tagged or ask your own question.