Setting up Smart Cards...where do I begin?

[ichiha68]

First post on here, love that this resource is available and I refer to it frequently! Had a question regarding setting up 2FA smart cards for my end users.

We currently use HID 1386 contactless cards to badge into the building (125Khz...?), and I'd like to be able to use them for the PCs as well. I don't know if this is feasible however, seeing as the cards come pre-programmed and I dont even know if it would meet NIST 800-171 guidelines. I got a quote for some HID cards model 1597 that include a smart chip, and the contactless standard we use to enter the building.

My question is, would these work to authenticate with Windows? By this I mean, could we use these cards for entry, and would the chip be compatible with Windows AD? Or is there a standard these chips have to meet to work properly? The standard I kept seeing was ISO 7816.

Also, what would I be looking for cost-wise to deploy this? The quote I got was for ~$1100 for 100 of the aforementioned cards. I'm willing to entertain this as it means we only have to carry one card, but if it would be considerably cheaper to just get new smart cards and have to carry an extra I'm willing to entertain that as well.

Thanks in advance!

[EduardoZamora]

Hello @ichiha68

Hope you are doing well.

My apologies, I am not completely aware of the requirements of Windows AD and the specifications of the contactless cards you are using (please consider contacting the manufacturer for further support).

After some quick research, HID 1386 cards appear to be 125 kHz LF proximity credentials intended for physical access control. That LF proximity technology by itself would not be sufficient for native Windows/Active Directory smart-card logon, because Windows smart-card sign-in seems to expect a supported smart-card interface/middleware where Windows can enumerate a user certificate and use the corresponding private key for authentication.

Regards,
Eduardo.