Force Smart Card Removal to Lock Workstation

Configuring Windows to automatically lock your workstation when a smart card is removed adds a critical layer of physical security to your environment. This guide explains how to enforce this behavior by modifying the Windows Registry using the Registry Editor (regedit), as well as configuring the prerequisite background service required for the policy to take effect.

Step 1: Enable the Smart Card Removal Policy Service

For the registry setting to function, the underlying Windows service must be running and set to start automatically.

1. Press Win + R, type services.msc, and press Enter.
2. Scroll down to locate Smart Card Removal Policy (Service name: SCPolicySvc).
3. Double-click the service to open its properties.
4. Change the Startup type to Automatic.
5. If the service is not running, click Start.
6. Click Apply and OK.

Step 2: Configure the Registry Setting

1. Press Win + R, type regedit, and press Enter to open the Registry Editor.

2. Navigate to the following path:

   HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

3. In the right pane, look for a String value named ScRemoveOption.

   • If it does not exist, right-click on an empty space, select New > String Value, and name it ScRemoveOption.

4. Double-click ScRemoveOption and set its Value data to 1.

Registry Option Reference:

• 0 = No Action (Default)
• 1 = Lock Workstation
• 2 = Force Logoff
• 3 = Disconnect Remote Desktop Session

5. Click OK to save the changes.
6. Close the Registry Editor.

Step 3: Apply and Test the Changes

1. Restart your computer or log out and log back in to apply the changes.
2. Insert your smart card and log into Windows.
3. Remove the smart card; the workstation should immediately transition to the lock screen.