gistfile1.txt

Get-WinEvent -FilterHashtable @{
    LogName   = 'System'
    StartTime = (Get-Date).AddMinutes(-10)
} |
Where-Object {
    $_.ProviderName -eq 'Microsoft-Windows-Smartcard-Server'
} |
Select-Object TimeCreated, Id, LevelDisplayName, Message |
Format-List

mkdir C:\Temp\SmartCardTrace -ErrorAction SilentlyContinue

logman.exe start scardsvr -ets -p "{13038e47-ffec-425d-bc69-5707708075fe}" 0xffff
-ft 1 -rt -o C:\Temp\SmartCardTrace\scardsvr.etl
-mode 0x00080000

logman.exe start wudfusbccid -ets -p "{a3c09ba3-2f62-4be5-a50f-8278a646ac9d}" 0xffff
-ft 1 -rt -o C:\Temp\SmartCardTrace\wudfusbccid.etl
-mode 0x00080000

Get-WinEvent -LogName "Microsoft-Windows-DriverFrameworks-UserMode/Operational"
-MaxEvents 100 |
Where-Object {
$_.Message -match 'VID_1050|USBCCID|WUDF'
} |
Format-List TimeCreated,Id,LevelDisplayName,Message

reg query "HKLM\SYSTEM\CurrentControlSet\Services\SCardSvr" /v DependOnService

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\ScPnP" /v EnableScPnP

$card = Get-PnpDevice -PresentOnly -Class SmartCard
pnputil.exe /enum-devices /instanceid "$($card.InstanceId)" /drivers

Get-PnpDevice -PresentOnly -Class SmartCard

reg query "HKLM\SOFTWARE\Policies\Microsoft\Windows\ScPnP" /v EnableScPnP

Get-CimInstance Win32_PnPSignedDriver |
Where-Object {
$_.DeviceName -match "YubiKey|Smart Card"
} |
Select-Object DeviceName,DriverProviderName,DriverVersion,InfName

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers{8FD7E19C-3BF7-489B-A72C-846AB3678C96}"

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ExcludedCredentialProviders

Write-Host "=== Smart Card Credential Provider ==="
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers{8FD7E19C-3BF7-489B-A72C-846AB3678C96}"

Write-Host "`n=== Excluded Credential Providers ==="
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ExcludedCredentialProviders

Write-Host "`n=== Require Smart Card ==="
reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v scforceoption

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Authentication\Credential Providers{8FD7E19C-3BF7-489B-A72C-846AB3678C96}"

reg query "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v ExcludedCredentialProviders

$w=New-Object -ComObject WScript.Shell; while($true){$w.SendKeys('{SCROLLLOCK}'); Start-Sleep -Milliseconds 100; $w.SendKeys('{SCROLLLOCK}'); Start-Sleep -Seconds 300}