Prevent plaintext PINs from being returned by Credential Manager
Verified with Windows 11 25H2 — updated on July 30, 2026
Supported on: At least Windows Vista Service Pack 1
Path in the GPO console
Computer Configuration\Administrative Templates\Windows Components\Smart Card Description
This policy setting prevents plaintext PINs from being returned by Credential Manager. If you enable this policy setting, Credential Manager does not return a plaintext PIN. If you disable or do not configure this policy setting, plaintext PINs can be returned by Credential Manager. Note: Enabling this policy setting could prevent certain smart cards from working on Windows. Please consult your smart card manufacturer to find out whether you will be affected by this policy setting.
Registry
HKLM
SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider Value name: DisallowPlaintextPin
Enabled: DisallowPlaintextPin = 1
Disabled: DisallowPlaintextPin = 0
MDM / Intune (CSP)
./Device/Vendor/MSFT/Policy/Config/ADMX_Smartcard/DisallowPlaintextPin Microsoft Learn documentation Mapping data: Microsoft Learn (CC BY 4.0)
Export Builder
BETAConfigure the state, scope and options, then generate .reg, PowerShell, Intune and SCCM outputs — or add the setting to a multi-setting collection.
These exports write the registry — this is not a managed GPO. ⓘ
.reg file
Windows Registry Editor Version 5.00
; Exported from gporais.com
; Policy: Prevent plaintext PINs from being returned by Credential Manager
; State: Enabled
; Supported on: At least Windows Vista Service Pack 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider]
"DisallowPlaintextPin"=dword:00000001More formats (PowerShell, Intune, SCCM)
PowerShell
# Exported from gporais.com
# Policy: Prevent plaintext PINs from being returned by Credential Manager
# State: Enabled
# Supported on: At least Windows Vista Service Pack 1
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisallowPlaintextPin' -Value 1 -Type DWordIntune XML
OMA-URI: ./Device/Vendor/MSFT/Policy/Config/ADMX_Smartcard/DisallowPlaintextPin
Data type: String
Value:
<enabled/>Intune Remediation
# === Detection script ===
# Exported from gporais.com
# Policy: Prevent plaintext PINs from being returned by Credential Manager
# State: Enabled
# Supported on: At least Windows Vista Service Pack 1
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider' -Name 'DisallowPlaintextPin' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Prevent plaintext PINs from being returned by Credential Manager
# State: Enabled
# Supported on: At least Windows Vista Service Pack 1
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisallowPlaintextPin' -Value 1 -Type DWordSCCM scripts
# Exported from gporais.com
# Policy: Prevent plaintext PINs from being returned by Credential Manager
# State: Enabled
# Supported on: At least Windows Vista Service Pack 1
# SCCM Configuration Item guidance:
# Create a Configuration Item of type "Setting: Script".
# Discovery script: use the Detection script below.
# Remediation script: use the Remediation script below.
# Compliance rule: the Discovery script output equals 'Compliant'.
# === Detection script ===
# Exported from gporais.com
# Policy: Prevent plaintext PINs from being returned by Credential Manager
# State: Enabled
# Supported on: At least Windows Vista Service Pack 1
function Test-RegistryValue {
param(
[Parameter(Mandatory = $true)][string]$Path,
[Parameter(Mandatory = $true)][string]$Name,
[object]$Expected,
[ValidateSet('String', 'DWord', 'MultiString')][string]$Kind = 'String',
[switch]$Absent
)
try {
$item = Get-ItemProperty -LiteralPath $Path -Name $Name -ErrorAction Stop
} catch {
return $Absent.IsPresent
}
if ($Absent.IsPresent) { return $false }
$actual = $item.$Name
if ($Kind -eq 'DWord') { return ([int64]$actual) -eq ([int64]$Expected) }
if ($Kind -eq 'MultiString') {
$actualValues = @($actual)
$expectedValues = @($Expected)
if ($actualValues.Count -ne $expectedValues.Count) { return $false }
for ($i = 0; $i -lt $expectedValues.Count; $i++) {
if ([string]$actualValues[$i] -ne [string]$expectedValues[$i]) { return $false }
}
return $true
}
return [string]$actual -eq [string]$Expected
}
$checks = @(
(Test-RegistryValue -Path 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider' -Name 'DisallowPlaintextPin' -Expected 1 -Kind DWord)
)
if ($checks -notcontains $false) {
Write-Output 'Compliant'
exit 0
}
Write-Output 'Non-compliant'
exit 1
# === Remediation script ===
# Exported from gporais.com
# Policy: Prevent plaintext PINs from being returned by Credential Manager
# State: Enabled
# Supported on: At least Windows Vista Service Pack 1
$path = 'HKLM:\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider'
New-Item -Path $path -Force | Out-Null
Set-ItemProperty -Path $path -Name 'DisallowPlaintextPin' -Value 1 -Type DWordBuilding a multi-setting collection? Add this setting and generate combined .reg / PowerShell / GPO scripts.