What does Windows error code 1264 (ERROR_SMARTCARD_SUBSYSTEM_FAILURE) mean?

 
Previous Next
ERROR_PKINIT_FAILURE ERROR_DOWNGRADE_DETECTED

ERROR_SMARTCARD_SUBSYSTEM_FAILURE

The smart-card infrastructure failed before Kerberos could authenticate.

ERROR_SMARTCARD_SUBSYSTEM_FAILURE is Win32 error 1264 (0x4F0). Kerberos attempted to use smart-card credentials, but a required layer in the Windows smart-card stack failed. The problem can lie below certificate validation: reader hardware, USB transport, Smart Card service, resource manager, card minidriver, CSP or KSP, credential provider, or the card itself.

Locate the failing layer

  • reader is absent, repeatedly disconnecting, or reported with a driver error
  • the Smart Card service is stopped or cannot communicate with the resource manager
  • the card ATR is not matched to the correct minidriver or provider
  • the certificate and private-key container cannot be enumerated
  • PIN operations, cryptographic signing, or card reset fail before Kerberos exchange

Evidence to capture

Record reader model, driver and firmware versions, card ATR, provider or minidriver name, Smart Card service state, session type, redirection state, and the first smart-card error preceding 1264. Collect Smart Card, CAPI2, Kerberos, System, and device-installation events. Never place PIN values or private-key material in logs.

Diagnostic sequence

Verify that Windows detects the reader and card consistently. Test enumeration of certificates and key containers before attempting domain sign-in. Compare another known-good card in the same reader and the same card in another reader to separate card, reader, and machine failures.

Inspect the Smart Card service and reader driver, then validate the vendor minidriver or cryptographic provider selected for the ATR. In Remote Desktop scenarios, determine whether the reader is local or redirected and test outside the remote session. A certificate visible in a user interface is not sufficient proof that the private key can perform the signing operation required by Kerberos.

Recovery

Restore the failed layer: reconnect or replace hardware, restart the affected service when safe, install the supported reader or minidriver package, or reissue a damaged card. Use vendor diagnostics for card-specific failures. Avoid deleting certificate stores or changing domain PKI until hardware and provider operations have been tested independently.

Difference from ERROR_PKINIT_FAILURE

Error 1263 concerns validation of the KDC certificate in the PKINIT exchange. Error 1264 indicates that Windows could not successfully use its own smart-card subsystem to supply the client credential operation.

Example

A user’s certificate appears on the sign-in tile, but authentication returns 1264. Smart Card events show that the minidriver fails when asked to sign the Kerberos preauthentication data. The same card works on a machine with the current minidriver, confirming that updating the provider is the appropriate fix.

References

Looking for a different code? Search another status or error code.