Code Block
Notes
For local smart card logon with cached credentials, there is no Certificate Revocation List (CRL) check. The CRL is only checked with there is a Domain Controller (DC) certificate and in the cached logon case there is no DC involved and therefore no CRL check.
An example scenario where this would be relevant is as follows:
-
You require smart card logon and issue smart cards.
-
A user uses their smart card in a machine and successfully logs on to the machine and the network.
-
User does not use laptop for a long time—maybe 30 days.
-
User attempts to use smart card logon after this period to log on to the machine, but the machine has not been put back on the network.
In this situation, the certificate on the smart card will be accepted for local logon even if the CRL has expired because no CRL check is performed.
