| Previous | Next |
| STATUS_SMARTCARD_WRONG_PIN | STATUS_SMARTCARD_CARD_NOT_AUTHENTICATED |
STATUS_SMARTCARD_CARD_BLOCKED
Why a blocked card behaves differently
STATUS_SMARTCARD_CARD_BLOCKED indicates that the credential-verification state on the smart card has been blocked. Unlike a single wrong-PIN response, the card can continue to reject verification even when the correct PIN is later supplied. Smart-card standards and PIV implementations use retry counters specifically to make repeated guessing costly; a card session ending does not necessarily reset a terminal blocked state.
Recovery is product- and issuer-specific. Some deployments permit an authorised unblock using a PUK or management workflow; others require a reset or card replacement. A help-desk response should therefore identify the card type, issuer policy and remaining recovery options before attempting any action that could also exhaust the PUK or erase credential material.
What not to do
- Do not keep retrying the PIN; that cannot clear a blocked state and can obscure the original cause.
- Do not try unknown PUK values or generic reset instructions on a production card without issuer approval.
- Record the reader, card serial or asset identity, user, time and preceding failed attempts for the support workflow.
- After authorised recovery, validate the complete logon path: PIN, private-key operation, certificate chain, KDC and account mapping.
References
- Microsoft Open Specifications: NTSTATUS reference
- Microsoft: smart-card PIN blocked at logon
- Yubico PIV commands and blocked-PIN behavior
- GlobalPlatform Card Specification
Looking for a different code? Search another status or error code.