Page Comparison

Changing the PIN on the Smartcard

If the YubiKey is still using the default PIN of 123456, it

must be changed before the end user can access Syracuse University resources.

You can find instructions for changing the

PIN on your Smartcard

here: https://

su-jsm.

atlassian.

net/wiki/x/

SAJECQ

Steps for Smartcard Renewal

Using

an AD-managed Windows computer:

1. Connect to the Server

   • Use

1. • Remote Desktop Connection (RDP) to connect to

1. • smartcard.syr.edu.

2. Log On

   • When prompted

1. • ,

1. • use your current YubiKey and

1. • PIN to log onto the server.

2. Launch the Smartcard Setup

   • On the server's desktop

1. • , locate the

1. • "Setup Smartcard" icon in the upper left and double-click

1. • it. A PowerShell window will launch, and the program will begin.

   • If not already inserted, plug the YubiKey into a USB port on the computer.

2. Monitor the Process

   • The process is now underway and

1. • may take a few moments.

2. Enter the PIN

   • When prompted

1. • , enter your current PIN.

   • Shortly after, you will be prompted to reenter the same PIN

1. • to add the root certificate, enhancing the versatility of your YubiKey.

2. Exit the Program

   • When the program states "press Enter to exit,"

1. • sign out of the RDP session by following these steps:

     • Go to the Start Menu, click on the silhouette of a person located just above the Start Menu, and select the "Sign Out" option.

2. Post-Process

   • After completing the process, direct login to any server using only the username and password, as done in step 2, will no longer be possible. Instead, you will be required to utilize the Smartcard and its associated PIN.

1. • If you are

1. • renewing your YubiKey, the PIN will remain unchanged.

2. Final Steps

   • Remove and

1. • reinsert the YubiKey

1. • into the USB port before

1. • attempting to use it.

   • If you have just renewed your smartcard, you might need to reboot your system before the Kerberos protocol can utilize the smartcard subsystem.

Troubleshooting

General

1. YubiKey Insertion

   • Ensure

1. • the YubiKey is properly inserted into the USB port.

1. • For USB-A style

1. • YubiKeys, it can be inserted in either orientation. When inserted correctly, the "y" on the card will flash green.

2. YubiKey Touch Button

   • The gold medallion on the YubiKey functions as a touch button. Pressing or touching it generates a One-

1. • Time Password (OTP) and simulates the Enter key press. Although this feature is not currently utilized, it may be used in the future.

2. Access Denied Warning

   • If you encounter an "Access Denied" warning while attempting to log into the server during step two, it is likely that your account has SmartcardLogonRequired set to true. In such cases, please contact your IT team for assistance.

3. Delayed PIN Prompt

   • If you are waiting for a PIN prompt

1. • for

1. • more than 20 seconds

1. • and it does not appear, click on the

1. • PowerShell window and press Enter twice. If the issue persists, please reach out to ITS for further support.

Windows Specific

1. Smart Cards Setting

   • Check the Smart Cards setting for a Yubico Minidriver under Device Manager on your computer. If the driver is not present and the computer is DOMAIN JOINED, restart the computer

1. • and check again. If the driver is still missing, contact ITS for assistance.

   • If the driver is not present and the computer is NOT DOMAIN JOINED, download the driver manually from Yubico's website

1. • : Download Yubico Smart Card Drivers. Go to http://yubico.com > Support > Downloads, find the CAB download for the Yubico mini-driver,

1. • extract it to a folder

1. • , right-click the .inf file, and select "Install." After the driver is installed, the computer may require a restart.

2. Certificate Validation Error

   • If you receive the error message "The client has failed to validate the domain controller certificate for _______. The following error was returned from the certificate validation process: A certificate chain could not be built to a trusted root authority." on a non-DOMAIN JOINED computer, it may mean the computer does not trust the root certificate from AD. Contact

1. • adtt@syr.edu for assistance with trusting the

1. • certificate.

macOS Specific

1. Network Level Authentication (NLA) Issues

   • Issue: Apple computers may

1. • face issues using the smartcard after setup due to Network Level Authentication (NLA). When attempting to connect to RDP,

1. • macOS may require a username and password before allowing the

1. • smartcard to be utilized,

1. • which can prevent the smartcard from functioning properly.

1. • Workaround: If you encounter this issue, one option is to use a Windows computer

1. • or virtual machine

1. • (VM) to connect via RDP. Once connected, you can use the Smartcard or YubiKey by selecting it from the "More Choices" option.

1. RDP Version and Smartcard Recognition

   • Ensure Compatibility: Make sure your Apple computer is running

1. • macOS and Microsoft Remote Desktop app Version 10 or later, as newer versions offer better support for smartcards.

   • Smartcard Not Detected:

     • If your smartcard is not being recognized during RDP connection setup, first ensure that the smartcard is being recognized by macOS itself. You can use the pcsctest tool available in the Terminal.app to verify smartcard detection.

     • If macOS recognizes the smartcard but the Microsoft Remote Desktop app does not, check the "Devices & Audio" or "Redirection" settings in the app to ensure that smartcard redirection is enabled. Reconnect to the session and try again.

2. First-Time Configuration Issues

   • Smartcard Not Appearing: If the Smartcard does not appear as an option when configuring it for the first time using the remote client application (assuming it is version 10+), it

1. • may indicate that the connection does not support Smartcards.

1. • • Fix: Exit the connection, right-click on it in the

1. • • Microsoft Remote Desktop client application, select "Edit," navigate to the

1. • • Devices tab, and ensure that "Smart Card" is checked. Reconnect to the session and try again.

     • Driver Consideration: Unlike Windows, macOS typically does not require additional drivers for most smartcards, including YubiKeys. However, keeping your system and Microsoft Remote Desktop app up-to-date is crucial for ensuring proper functionality.

If issues persist, consider reaching out to ITS for further support or explore additional troubleshooting based on your specific environment’s configurations.