I'm in the process of configuring USB Yubikeys as a smart card for our company so that staff can elevate to an admin account (added to the computer's local administrators group) by simply inserting the key and typing a PIN.
If possible I would like to disable the option to interactively login to windows using the smart card; we just want it for UAC prompts (e.g. to install software).
Things I tried:
Certificate templates -- removed the 'smart card logon' (but kept 'client authentication') from the Extensions.
AD Users and Computers -- (un)ticked 'smart card is required for interactive logon'.
regedit -- toggled the 'scforceoption'
gpedit.msc -- toggled 'Interactive Logon: Require smart card' (could be the same as the 'scforceoption'?)
Local Services -- toggled 'smart card plug and play service'
Should I look at Windows logon settings, certificate uses configuration, CA templates or the specific smart card device for limiting the use to only have it work with UAC and prevent interactive logons?
Not sure if this should be moved to the 'Cryptography' StackExchange.