Windows: how to disable scanning of Smart Cards

Question

Under Windows (at least, 8 and 10), when a Smart Card is inserted in a PC/SC Smart Card reader, something in the OS typically issues Select commands (C-APDUs starting in 00 A4) to the Smart Card, as part of scanning for certificates for automated logon.

How can this scanning be avoided, without disabling the SCardSvr service responsible for PC/SC, so that SCardTransmit and the like remain usable? This scanning can be an issue when the Smart Card is unable to process the Select command and becomes inoperable (for some reason like being in a debug mode).

I'm aware that under gpedit.msc, Computer configuration, Administration templates, Windows components, Smart Card, setting Enable Plug and Play Smart card Service to Disabled avoids recognition of Smart Cards as plug-and-play devices. It however does not disable said scanning.

Solution

The only way to stop the scan is to disable the device or stop all smart card services.

Start/stop smart card system services

For system services, there are three that are associated with smart cards. The main one is SCardSvr, but a second one is ScDeviceEnum or the Smart Card Device Enumeration Service. On my computer the Startup type for both is Manual, so I assume yours are too (better check it).

Disabling the second service may be enough, done this way:

sc config ScDeviceEnum start= disabled
sc stop ScDeviceEnum

Note the blank after start=. Enabling is done with:

sc config ScDeviceEnum start= demand

You may create two .bat files with these command(s), to disable and enable the service(s) (one or both). It is also possible to create desktop shortcuts to the two files for fast execution. I don't really know, and hope that a reboot is not required.

Start/stop smart card device

You may use the Microsoft utility of Windows Device Console (Devcon.exe), downloaded from github DevCon-Installer (click "releases"), to enable and disable drivers.

To see an example of using Devcon, see the post in ss64.com.

The commands to disable and enable a device are:

devcon.exe disable "name of smart card device"
devcon.exe enable "name of smart card device"

The name of the smart card device can be found in Device Management.

As said before, these two commands can be stored in two .bat files.

For testing, try all commands first in an elevated Command Prompt.

Comments

[Ramhound]

Only Windows 8+ have built-in Smart Card support.

[harrymc]

The only way to stop the scan is to disable the device or stop all smart card services. Both operations can be done via simple .bat files. Is that an acceptable solution?

[fgrieu]

@harrymc: bat, regedit, anything will do. But SCardTransmit must remain usable, thus "stop all smart card services" won't do if that includes SCardSvr. On the other hand, maybe the scan is not performed by ScardSvr, but rather by some other services using ScardSvr for that.

[harrymc]

There is more than one direction that this question can go. Below is the first try, which I cannot test since I'm lacking a smart card device.

[fgrieu]

I did not downvote, but: ScDeviceEnum reportedly "Creates software device nodes for all smart card readers accessible to a given session. If this service is disabled, WinRT APIs will not be able to enumerate smart card readers". From that description (did not try), Smart Card readers won't be usable with SCardTransmit if this service is disabled.

[harrymc]

The problem is that scanning is part of the normal functioning of the driver or of some service (it will take testing to determine which one). I haven't found any parameter that stops this behavior, so the only choice is to entirely stop the responsible service or device. Going more deeply into the functioning of the driver or service in question will require having the source-code, which we don't have, and modifying will require re-compiling or at least patching.

[harrymc]

I think that your first step should be to run the tests, using my above answer, to isolate the responsible piece of software. That will let us better concentrate the research, where you are also a part. Could you please explain why it's important to avoid disabling the SCardSvr service even when the smart card is not in use.

[Mark]

I do not get why it is downvoted, it worked perfectly for me, I do not use the card reader anyway.