Under local group policy editor, is there a way to disable change smart card PIN at Ctl Alt Del? We don't want our users changing their PINs for their smart cards on their computers. I hope this makes sense.
I found this registry hack:
...follow these steps to enable or disable the function that lets users change the smart card PIN:
1. Start Registry Editor. To do this, press the Windows logo key+R, type regedit, and then click OK.
2. Locate and then click the following registry key:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\
3. On the Edit menu, point to New, and then click Key.
4. Type SmartCardCredentialProvider, and then press Enter.
5. On the Edit menu, point to New, and then click DWORD Value.
6. Perform one of the following actions, based on the kind of smart card on which you want to restrict functionality:
· For VSCs, type AllowVirtualSmartCardPinChangeAndUnlock, and then click Modify.
· For physical smart cards, type AllowSmartCardPinChangeAndUnblock, and then click Modify.
7. Type 1 in the value data box, and then click OK.
Note If you set either the AllowVirtualSmartCardPinChangeAndUnlock or AllowSmartCardPinChangeAndUnblock value to 1, users can change the format of the PIN. If you set the value to 0, users cannot change the format of the PIN.
Quote