| Previous | Next |
| STATUS_DOWNGRADE_DETECTED | STATUS_ISSUING_CA_UNTRUSTED |
STATUS_SMARTCARD_CERT_REVOKED
The credential can be present but no longer trusted
STATUS_SMARTCARD_CERT_REVOKED means that certificate-based authentication reached certificate validation and the credential is no longer accepted because of revocation. This is not a PIN problem and not necessarily a reader failure: the card can be detected and its private key can be available while the certificate is invalid for authentication. In Windows smart-card logon, the KDC and certificate-chain policy are part of the decision.
PKINIT defines how public-key credentials participate in the Kerberos initial-authentication exchange. Windows auditing documentation associates relevant KDC result conditions with revoked smart-card certificates or a chain that the domain controller does not trust. The response should be to preserve the validation evidence and use the established PKI lifecycle process, not to bypass revocation checks.
What to verify
- Identify the exact certificate, issuer, serial number, intended EKU and revocation information used by the failed logon.
- Check whether the certificate was intentionally revoked, superseded or replaced, and whether a valid replacement has been issued to the user.
- Verify the KDC’s trust and revocation-access path; distinguish a known revoked certificate from an inability to obtain revocation status.
- Keep PIN, reader and certificate-chain troubleshooting separate so one issue is not mistaken for another.
References
- Microsoft Open Specifications: NTSTATUS reference
- RFC 4556: PKINIT
- Microsoft: Event 4769, Kerberos service-ticket auditing
- Microsoft: smart-card certificate requirements
Looking for a different code? Search another status or error code.