Skip to content

Authentication · Stand-alone computers

EIDAuthenticate

Smart card logon for stand-alone computers and local accounts — no domain controller required.

Request a free trial Buy a license

Version 2.0 · 30-day full-featured trial · no credit card required

Overview

EIDAuthenticate brings smart card logon to the local accounts of Windows computers that are not managed by Active Directory — stand-alone workstations, servers in a workgroup, or local administrator accounts on domain-joined machines. It offers the same guarantees as Microsoft's domain smart card logon, without a domain controller, a directory or an enterprise PKI.

The certificate of a smart card is associated with a local account. At logon, possession of the card and knowledge of its PIN replace the password. Windows builds the same session as for a password logon, so everything that depends on the account secret keeps working: DPAPI, EFS, Credential Manager, network access with the account.

Logon, unlock and UAC
The card and its PIN at the Windows logon screen, on the lock screen and in credential prompts (UAC, CredUI).
Smart card enforcement
The Windows “Force smart card logon” policy, or the per-account “smart card required” flag.
Kiosk mode for PIV cards
A dedicated mode for kiosks, shared workstations, shift work and public terminals, designed for PIV (FIPS 201) and CAC cards: insert the card, enter the PIN, and the session opens — no username to type.
Card removal
Lock the session, log off or disconnect when the card is pulled out.
Network authentication
Remote Desktop, PowerShell remoting (WinRM), file shares (SMB) and any SSPI application, with the card.
Run as another account
EIDRunAs starts a program under another local account after authenticating that account's card — also from a standard user session.
Audit trail
A documented Windows event channel: which card opened which session, why a logon was refused, who changed an association.
See it in action

From a smart card to a Windows logon, in about a minute:

  1. Open the configuration wizard from the Start menu
  2. Create a certificate on the card, or pick one already on it
  3. Confirm the account password once: the wizard then tests the card with its PIN
  4. Lock the session and sign in with the card and its PIN
Screenshots
Smart card logon A tile per usable certificate on the Windows logon screen: type the PIN of the card.
Configuration wizard Associate or dissociate certificates, configure another account, set the policies.
Select a certificate The wizard lists the certificates of the card, or creates and imports one.
Tested before use The wizard checks the certificate and the PIN before the first logon.
Force smart card logon Make the card mandatory for every account of the computer, in one click.
Run as another account EIDRunAs starts a program under another account with that account's card.
Audit events Every logon, refusal and configuration change in its own Windows event channel.
Built-in diagnostics EID Log Manager: live tracing, persistent tracing across restarts, crash dumps.
What's new in version 2.0
Network authentication
A NegoEx security package: WinRM / PowerShell remoting and file shares (\\server\share) with the card, through a new kernel-mode package for the SMB server.
Run as another account
New EIDRunAs tool and EIDSecondaryLogon service: start a program under another local account with its card, also from a standard user session.
Still no password used behind the scene
Only one-way hashes of the account password are stored, encrypted with the card and re-keyed after every successful logon as required by DPAPI. Except for that, no traces of a password.
Audit trail
A new MySmartLogon-EIDAuthenticate/Operational event channel with documented, stable event IDs, ready for a SIEM.
No reboot
The security packages are registered live at installation: the product works immediately, without restarting the computer.
Scripting
New EIDCmd commands: /LIST, /LISTALL, /REMOVEALL, /REQUIRESMARTCARD, /GETUSERNAME.
Refreshed tools
Redesigned configuration wizard and EID Log Manager (live tracing window, persistent tracing, crash dumps); repair no longer asks for the serial number.
Platforms
x64 and ARM64. Installer in 10 languages. Windows XP, Server 2003 and 32-bit Windows remain served by version 1.x.
Remote access with the card

The smart card is not only for the console. Through Negotiate/NegoEx, the card authenticates the user to another computer that runs EIDAuthenticate — with no password typed, and no password sent.

ScenarioHowWhat you need
Remote Desktop (NLA)CredSSP carrying Negotiate/NegoExEIDAuthenticate on both computers; the card associated on the server
Remote Desktop without NLASmart card redirection, logon inside the sessionEIDAuthenticate on the server
PowerShell remoting (WinRM)Negotiate (NegoEx), no CredSSP neededEIDAuthenticate on both computers; association on both; TrustedHosts in a workgroup
File shares (SMB)Negotiate (NegoEx), kernel pathEIDAuthenticate on both computers, including its kernel package on the server
Your own protocolsAny SSPI client using the Negotiate packageEIDAuthenticate on both ends
Requirements
Operating system
  • Windows 11, Windows 10 — x64 and ARM64: all features
  • Windows Server 2025, 2022, 2019, 2016 — x64: all features
  • Windows 8.1, 7 SP1 — Server 2012 R2, 2008 R2 (x64): local logon
  • Windows XP, Server 2003 and 32-bit editions: use version 1.x

EIDAuthenticate handles local accounts. Domain accounts use the smart card logon built into Active Directory (Kerberos PKINIT).

Smart card
  • A card with a Windows minidriver (Microsoft Smart Card Key Storage Provider / Base Smart Card Crypto Provider) or a vendor CSP
  • Cards exposing only PKCS#11 are not supported
  • A reader supported by the card vendor, typically CCID

No card at hand? EIDVirtual turns a USB key into a smart card that works with EIDAuthenticate.

Secure design

Unlike most logon programs that require specific smart card drivers or user-space processes, EIDAuthenticate performs authentication inside the Windows security kernel (lsass.exe). This means even signature-only cards keep your data safe.

EIDAuthenticate is the only solution natively supporting the Windows "Force Smart Card Logon" policy — used to secure local administrator accounts in data centers and to comply with HSPD-12.

1 Detection — the credential provider detects the inserted smart card.
Internationalization

The installer, the logon screen and the tools are available in 10 languages: English, French, German, Spanish, Italian, Czech, Lithuanian, Japanese, Simplified Chinese and Traditional Chinese (Hong Kong). The language follows the display language of Windows.

FAQ

EIDAuthenticate is the Enterprise Edition, for organizations and governments, developed with a secure development lifecycle — this page describes its version 2.0.

No. Version 2.0 registers its security packages in the running system: smart card logon works as soon as the installation ends. Upgrading from a 1.x release is the exception: the logon screen asks for a restart until the new package is loaded.

No. Only one-way hashes of the password are used, encrypted with the key of the card, and re-keyed after every successful logon. When the account password changes, the stored credential follows it. Even if the secrets are changed off-line, EIDAuthenticate continues to work.

Yes. The security packages are signed by Microsoft for loading into a protected LSASS, and the kernel package carries the Microsoft hardware signature.

EIDAuthenticate handles local accounts, including the local accounts of domain-joined computers. Domain accounts use the smart card logon built into Active Directory (Kerberos PKINIT).

Unless smart card logon is enforced, the account password still works. When it is enforced, an administrator can disable the policy from the logon screen. EIDCmd /DELETE or /REMOVEALL removes associations from scripts.

Yes. The MSI installs without any prompt with the serial number as a property, and EIDCmd associates certificates, lists them and manages the license from scripts.

EIDAuthenticate may be eligible for FIPS 201 certification. However, authentication software is not yet in the GSA certification categories.

Audits can be conducted by government entities on demand. Please contact us for pricing.