To fully support smart card login, you can do either one of the following.

Related Articles TIPS A Centrify Server Suite Cheat Sheet HOWTO: Manually install and join AD with the Centrify Express agent Cheat Sheet - DirectAudit Commands on Unix & Linux Systems Basics Understanding how Active Directory Functional Levels affect Centrified Systems How To Setup Centrify PIM for Google Compute Engine Linux VM Instances Centrify 17.1, 17.1 Hotfix 1 & Hotfix 2 Release. Centrify Identity Service, Mac Smart Card Edition enables IT administrators to manage and secure Mac OS X systems using existing tools and processes so that Macs become a security peer to Windows systems. Centrify extends its proven Centrify for Mac solution with support for the most commonly used.

Configure a computer to require smart card login by enabling the Require smart card login group policy (Computer Configuration > User Configuration > Policies > Centrify Settings > Mac OS X Settings > Security & Privacy > Require smart card login.) When you enable this policy, no one can log into a computer for which this policy applies with a user name and password but must insert a smart card, unless you create an exception group. An exception group is simply an Active Directory group that you create and add to this group policy to allow group members to log in, if necessary, with a user name and password. The purpose of creating an exception group is to allow users to temporarily log in if they do not have their smart card in hand.
Note: If you use set this policy, be certain that all users have their passwords set to never expire. Otherwise, if a password expires, a user may be unable to log in with a smart card and see a potentially confusing error message about changing their password. If you use the option to require smart card login for specific users, as explained in the next bullet, you can ignore password expiration.
Set an individual user’s account options to require login with a smart card, as shown in the following procedure. When you set this option, the user cannot interactively log in to a computer with a user name and password but must insert a smart card. Do not use this option if you want to allow specific users to log in temporarily with a user name and password in case they do not have their smart card with them. In this case, use the Require smart card login group policy and create and add an exception group.

Related Articles KB-1617: Troubleshooting smart card issues on Mac systems KB-6041: How to show current license type in use by adclient KB-6040: How to change the license type in use after adclient successful joined to the AD? KB-3415: How to enable Smart Card logon support on RedHat environments. For a single-user card, before enabling smart card support, make sure you do the following: Provision a smart card with an NT principal name and PIN. Refer to Supported smart card profiles to verify that the profiel on your smart card is supported by Centrify. Verify that the Active Directory Zone user’s UPN matches the UPN on the smart card. The smart card support module is an additional $30 per system. Current Centrify Suite customers can download DirectControl for Mac by logging in to the Centrify Download Center. Users of Centrify Express, or those wanting to try Centrify’s Active Directory authentication solution for Mac OS X, can download the free Centrify Express for Mac OS X.

To require smart-card login for a specific user: Inventor 2011 64bit full crack.

Open the Access Manager console or Active Directory Users and Computers.
Select the user. For example, in the Access Manager console, open domainName > Zones > zoneName > Users > userName.
Right-click the userName and select Properties.
Select the Account tab.
In Account options, scroll until Smart card is required for interactive logon is visible, then select it.
Click OK.

We recommend configuring your Active Directory domain and forest to use AES-128 or AES-256 encryption for Kerberos in order to ensure you can configure smart card login. DES and RC4 encryption are no longer supported. Other prerequisites for enabling smart card support differ depending on whether you have configured a single-user or multi-user smart card.

For a single-user card, before enabling smart card support, make sure you do the following:

Provision a smart card with an NT principal name and PIN.
Refer to Supported smart card profiles to verify that the profiel on your smart card is supported by Centrify.
Verify that the Active Directory Zone user’s UPN matches the UPN on the smart card.

For a multi-user card, before enabling smart card support, make sure you have the following in place:

A Windows Server 2008 or above domain controller for authentication.
The card is not configured with a UPN. If a card with a UPN is inserted, the Mac prompts for a PIN rather than prompting for a username and password.
An administrator has added the certificate on the card to the name mapping for the users the card is associated to. See the following Microsoft Technet Blog post: 'Mapping One Smart Card to Multiple Accounts' for more information on how to do this.

Centrify Express For Mac Smart Card

For either type of card, verify that the public key infrastructure to support smart card login is operational on the Windows computer running Active Directory and Access Manager. If the user is able to log in to a Windows computer with a smart card, and you have a card reader and a fully-provisioned card for the Mac computer, the user should be able to log in to the Mac computer once you configure it for smart card support.