A Terminal Server smartcard logon using RDP 6.0 may fail with error code 0x507

Article translations Article translations
Close Close
Article ID: 968005 - View products that this article applies to.
Expand all | Collapse all
Source: Microsoft Support

RAPID PUBLISHING

RAPID PUBLISHING ARTICLES PROVIDE INFORMATION DIRECTLY FROM WITHIN THE MICROSOFT SUPPORT ORGANIZATION. THE INFORMATION CONTAINED HEREIN IS CREATED IN RESPONSE TO EMERGING OR UNIQUE TOPICS, OR IS INTENDED SUPPLEMENT OTHER KNOWLEDGE BASE INFORMATION.

Symptom



A Terminal Server smartcard logon using RDP 6.0 may fail with error code 0x507 (authentication error).

 

Error code details:

  • Hex: 0x507

  • Decimal: 1265

  • Symbolic Error:  ERROR_UNIDENTIFIED_ERROR

  • Friendly Error: Insufficient information exists to identify the cause of failure.

Cause



For smartcard authentication to work over terminal services, the user certificate must be present in the certificate store, and it must match the selected certificate on the smartcard. This is unlike local logon where the certificate only needs to be present on the smartcard. If the Certificate Propagation service (certpropsvc) is not running on the client machine, the certificate is not propagated to the user store. This leads to the error condition. This is usually seen when a new certificate is issued that is not propagated to the user store because the Certificate Propagation service was stopped.

Resolution



The smartcard reader is responsible for starting the Certificate Propagation service as a part of the INF installer. Make sure all reader drivers have the following section in their INF:

  • [Reader.Install.AddReg]

  • HKLM, Software\Microsoft\Cryptography\Calais\Readers,,,

  • HKLM, System\CurrentControlSet\Services\SCardSvr,Start,0x00010001,2

  • HKLM, System\CurrentControlSet\Services\CertPropSvc,Start,0x00010001,2 


If the Certificate Propagation service does not occur, contact the reader vendors and have them update their drivers.



Workaround

 

As a workaround, start the service manually. Normally, set the Certificate Propagation service to start automatically in the ‘service.msc’ snap-in.

More Information



The ‘sc queryex certpropsvc’ command or the ‘services.msc’ snap-in may be used to determine whether the service is running.

DISCLAIMER

MICROSOFT AND/OR ITS SUPPLIERS MAKE NO REPRESENTATIONS OR WARRANTIES ABOUT THE SUITABILITY, RELIABILITY OR ACCURACY OF THE INFORMATION CONTAINED IN THE DOCUMENTS AND RELATED GRAPHICS PUBLISHED ON THIS WEBSITE (THE “MATERIALS”) FOR ANY PURPOSE. THE MATERIALS MAY INCLUDE TECHNICAL INACCURACIES OR TYPOGRAPHICAL ERRORS AND MAY BE REVISED AT ANY TIME WITHOUT NOTICE.

TO THE MAXIMUM EXTENT PERMITTED BY APPLICABLE LAW, MICROSOFT AND/OR ITS SUPPLIERS DISCLAIM AND EXCLUDE ALL REPRESENTATIONS, WARRANTIES, AND CONDITIONS WHETHER EXPRESS, IMPLIED OR STATUTORY, INCLUDING BUT NOT LIMITED TO REPRESENTATIONS, WARRANTIES, OR CONDITIONS OF TITLE, NON INFRINGEMENT, SATISFACTORY CONDITION OR QUALITY, MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE, WITH RESPECT TO THE MATERIALS.

Properties

Article ID: 968005 - Last Review: February 16, 2009 - Revision: 1.0
APPLIES TO
  • Windows Vista Enterprise 64-bit Edition
  • Windows Vista Enterprise
  • Windows Server 2008 Enterprise
Keywords: 
kbnomt kbrapidpub KB968005

Give Feedback

 

Contact us for more help

Contact us for more help
Connect with Answer Desk for expert help.
Get more support from smallbusiness.support.microsoft.com