Windowsserverdocs: Smart card explanation

[poortom1004]

I believe it would be worthwhile to explain why we should implement the policy setting Smart card is required for interactive logon and what the implications are. Such as what does this mean when you need to do a first recovery and you need to boot into DSRM.

---

Document Details

⚠ Do not edit this section. It is required for docs.microsoft.com ➟ GitHub issue linking.

• ID: 8499f8c0-64c7-2b6e-9022-115ed3d69904
• Version Independent ID: 9bf515dd-a4e4-baf2-8c18-0d0d76dd5eb0
• Content: Appendix D - Securing Built-In Administrator Accounts in Active Directory
• Content Source: WindowsServerDocs/identity/ad-ds/plan/security-best-practices/Appendix-D--Securing-Built-In-Administrator-Accounts-in-Active-Directory.md
• Product: windows-server-threshold
• GitHub Login: @MicrosoftGuyJFlo
• Microsoft Alias: joflore

[MicrosoftGuyJFlo]

@poortom1004 these are just recommendations. Organizations must look at these and determine what is feasible for their environment and what changes they are comfortable with.

[MicrosoftGuyJFlo]

please-close

[poortom1004]

I guess what I'm saying is that the Administrator account is the only one that was mentioned to set this policy setting on. It wasn't mentioned to turn this policy setting on any of the other accounts. Just curious if implementing this setting meant that it does something that wouldn't really be that obvious to the casual reader.

[MicrosoftGuyJFlo]

Requires physical presence in front of the DC with the smartcard assigned to the admin account.

[poortom1004]

ok, this makes sense to implement even if smart cards aren't being used in the org based on what you're saying, by ensuring that physical access is required to log into the server, instead of simply opening a remote console to the server.

[poortom1004]

Perhaps it may make sense to explain this in the article for admins unfamiliar with PKI experience or with no PKI environment. Would hate for an admin to configure the requirement for a smart card to login, only to realize the account can't be logged in to if they have no PKI environment.