Enforce Smart Card Removal Lock via Regedit

Enforcing a smart card removal policy ensures that a Windows workstation automatically locks the moment a user disconnects their physical smart card. This article explains how administrators can configure the Windows Registry (regedit) to set the smart card removal behavior to immediately lock the desktop, as well as ensure the required background service is enabled to process the event.

Step 1: Configure the Winlogon Smart Card Removal Action

To define the action Windows takes when a smart card is removed, modify the Winlogon registry key:

  1. Press Win + R, type regedit, and press Enter to open the Registry Editor.
  2. Navigate to the following path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
  3. Locate or create a String Value (REG_SZ) named ScRemoveOption.
  4. Double-click ScRemoveOption and set its Value data to 1.
    • 0 = No action
    • 1 = Lock Workstation (Locks the desktop immediately)
    • 2 = Force Logoff
    • 3 = Disconnect Remote Desktop Session

Step 2: Enable the Smart Card Removal Policy Service

The registry configuration requires the Smart Card Removal Policy service (SCPolicySvc) to be running. If this service is disabled or stopped, the removal trigger will not function.

You can set this service to start automatically via the registry:

  1. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SCPolicySvc
  2. Locate the Start DWORD (REG_DWORD) value.
  3. Double-click Start and change the value data to 2 (Automatic).
    • 2 = Automatic
    • 3 = Manual
    • 4 = Disabled

Step 3: Apply and Test the Changes

  1. Open an elevated Command Prompt or PowerShell and start the service immediately:

    net start SCPolicySvc

  2. Alternatively, restart the computer to apply both registry modifications.

  3. Log in using a smart card, then remove the card from the reader. The desktop should lock immediately.