sebastianbayer

Hello,

Thank you for your time. I'll test this as soon as 2026.2.14 arrives and reply back.

For your first case: This sounds like you're using a KSP-only Smartcard (ECC?)? If yes, then this is what I'd expect. DisableCapiOverrideForRSA does not Address KSP auth-flows. If your workaround makes this work, then it'd be case closed.

For your second case: I remember having this case in one of my testing scenarios aswell. Unfortunately I don't remember exactly what it was. I am pretty sure I wrote it off to some unrelated or nonsensical configuration. Maybe something to do with the elliptic curve cryptography policies and the issued ECC certificate. What certificate types did you test with?

kind regards,

Sebastian

Hello,

Thanks for letting me know.

So you aim to have the new API workflow implemented before the new deadline?

Thanks

Sebastian

Hello Richard,

Sorry this took a bit longer. I tested with the ECC Certificates today, but the Error in RDM is the same (LSA unreachable).

Without setting the PIN on the certificate it selects the correct Certificate an then asks for the PIN, but this always works, no matter the Configuration

DisableCapiOverrideForRSA (obviously) does not change this behavior.

So basically RDM is unable to use KSP Smartcards for RDP with the PIN saved. With DisableCapiOverrideForRSA=0 and RSA KSP Smartcards it only works for mstsc and RDM because RDM is allowed to fallback to CSP.

Kind Regards,

Sebastian

Hello,

The thing I'm suspecting, is that since the certificate is chosen by thumbprint, it chooses the wrong one. For me certutil -scinfo for RSA KSP Certificates gives back both, CSP and KSP in the same Slot, both with the same Thumbprint.

ECC Certificates don't have the CSP Slot since the're KSP-only. That yould at least make it logical for me, that with only a CSP cert in mstsc, i get the same error as with RDM regardless.

If I find time today or tomorrow, I'll try if ECC works and report back.

BR Sebastian

Hello Richard,

Thanks for letting me know! I just wasn't able to find any Bug Report regarding the Issue.

Do you know if the Error only occurs with RSA KSP Certificates or also with ECC Certificates?

If there's anything I can do to help you fix the issue, just let me know.

BR Sebastian

Hi,

I’m seeing an issue with smart card logon when using Remote Desktop Manager.

The same smart card certificates work fine with the native Microsoft RDP client (mstsc.exe).

Environment

• Remote Desktop Manager: 2025.2.30 & 2025.3.23

• Client OS: Windows 11 24H2 & 25H2 after 26100.6899/26.200.6899 -> Resolved issues in Windows 11, version 24H2 | Microsoft Learn

• RDS host OS: Windows Server 2016-2025

• Auth: on-prem AD domain

• Smart cards: YubiKey 5 NFC (PIV) and Windows Virtual Smart Card

• Registry on the client:

• HKLM\SYSTEM\CurrentControlSet\Control\Lsa\DisableCapiOverrideForRSA

  • 0 → no issue

  • 1 → issue described below occurs

• Certificates on both Smartcards:

  • RSA 2048, Smart Card Logon + Client Authentication EKUs, UPN in SAN

  • Template configured for Microsoft Smart Card Key Storage Provider

  • certutil -scinfo shows the same key via

  • Microsoft Base Smart Card Crypto Provider and

  • Microsoft Smart Card Key Storage Provider

• Smart card logon and RDP via mstsc.exe work correctly with these certs (with the reg-key both 0 and 1).

Problem

In RDM I created an X.509 certificate credential:

• Mode: Link to certificate store

• Location: Current user / Personal

• Find type: Thumbprint (of the smart card logon cert)

• PIN stored in the credential

This credential is used by an RDP (Microsoft Remote Desktop) session with NLA enabled.

Result (only when DisableCapiOverrideForRSA = 1):

The RDP connection is established, but logon fails with:

“An authentication error has occurred. The Local Security Authority cannot be contacted (LSA is not reachable).”

If I:

• set DisableCapiOverrideForRSA back to 0, or

• configure the same RDP session in RDM without using the X.509 credential and just rely on normal smart card redirection (like mstsc),

then logon works.

Expected

Using an X.509 credential in RDM should behave the same as mstsc.exe and allow smart card logon with these RSA/KSP-capable certificates (YubiKey and Virtual Smart Card), even when DisableCapiOverrideForRSA is set to 1. After April 2026 the DisableCapiOverrideForRSA Workaround won't be available anymore.

Is this a known limitation of the X.509 credential type with smart cards / KSP, or is there a recommended workaround?

Thanks!

Hello,

This feature is working as expected, but the UI does not represent the set value and instead always shows "Legacy"

regards,

Sebastian