<displayName>enter display name here</displayName>
<description>enter description here</description>
<resources>
<stringTable>
<string id="AllowCertificatesWithNoEKU">Allow certificates with no extended key usage certificate attribute</string>
<string id="AllowCertificatesWithNoEKU_help">This policy setting lets you allow certificates without an Extended Key Usage (EKU) set to be used for logon.
Under previous versions of Microsoft Windows, the EKU extension was required to have the smart card logon Object Identifier (OID) present. This setting controls that restriction.
If you enable this policy setting, only those smart card based certificates that contain the smart card logon OID or no EKU extension will be listed on the logon screen.
If you disable or do not configure this policy setting then only those smart card based certificates that contain the smart card logon OID will be listed on the logon screen.</string>
<string id="AllowIntegratedUnblock">Allow Integrated Unblock screen to be displayed at the time of logon</string>
<string id="AllowIntegratedUnblock_help">This policy setting lets you determine whether the integrated unblock feature will be available in the logon User Interface (UI).
In order to use the integrated unblock feature your smart card must support this feature. Please check with your hardware manufacturer to see if your smart card supports this feature.
If you enable this policy setting, the integrated unblock feature will be available.
If you disable or do not configure this policy setting then the integrated unblock feature will not be available.</string>
<string id="AllowSignatureOnlyKeys">Allow signature keys valid for Logon</string>
<string id="AllowSignatureOnlyKeys_help">This policy setting lets you allow signature key-based certificates to be enumerated and available for logon.
If you enable this policy setting then any certificates available on the smart card with a signature only key will be listed on the logon screen.
If you disable or do not configure this policy setting, any available smart card signature key-based certificates will not be listed on the logon screen.</string>
<string id="AllowTimeInvalidCertificates">Allow time invalid certificates</string>
<string id="AllowTimeInvalidCertificates_help">This policy setting permits those certificates to be displayed for logon that are either expired or not yet valid.
Under previous versions of Microsoft Windows, certificates were required to contain a valid time and not be expired. The certificate must still be accepted by the domain controller in order to be used. This setting only controls the displaying of the certificate on the client machine.
If you enable this policy setting certificates will be listed on the logon screen regardless of whether they have an invalid time or their time validity has expired.
If you disable or do not configure this policy setting, certificates which are expired or not yet valid will not be listed on the logon screen.</string>
<string id="FilterDuplicateCerts_help">This policy settings lets you configure if all your valid logon certificates are displayed.
During the certificate renewal period, a user can have multiple valid logon certificates issued from the same certificate template. This can cause confusion as to which certificate to select for logon. The common case for this behavior is when a certificate is renewed and the old one has not yet expired. Two certificates are determined to be the same if they are issued from the same template with the same major version and they are for the same user (determined by their UPN).
If there are two or more of the "same" certificate on a smart card and this policy is enabled then the certificate that is used for logon on Windows 2000, Windows XP, and Windows 2003 Server will be shown, otherwise the the certificate with the expiration time furthest in the future will be shown. Note: This setting will be applied after the following policy: "Allow time invalid certificates"
If you enable or do not configure this policy setting, filtering will take place.
If you disable this policy setting, no filtering will take place.</string>
<string id="CertPropEnabledString">Turn on certificate propagation from smart card</string>
<string id="CertPropEnabledString_help">This policy setting allows you to manage the certificate propagation that occurs when a smart card is inserted.
If you enable or do not configure this policy setting then certificate propagation will occur when you insert your smart card.
If you disable this policy setting, certificate propagation will not occur and the certificates will not be made available to applications such as Outlook.</string>
<string id="CertPropRootCleanupString_help">This policy setting allows you to manage the clean up behavior of root certificates. If you enable this policy setting then root certificate cleanup will occur according to the option selected. If you disable or do not configure this setting then root certificate clean up will occur on log off.</string>
<string id="CertPropRootEnabledString">Turn on root certificate propagation from smart card</string>
<string id="CertPropRootEnabledString_help">This policy setting allows you to manage the root certificate propagation that occurs when a smart card is inserted.
If you enable or do not configure this policy setting then root certificate propagation will occur when you insert your smart card. Note: For this policy setting to work the following policy setting must also be enabled: Turn on certificate propagation from smart card.
If you disable this policy setting then root certificates will not be propagated from the smart card.</string>
<string id="DisallowPlaintextPin">Prevent plaintext PINs from being returned by Credential Manager</string>
<string id="DisallowPlaintextPin_help">This policy setting prevents plaintext PINs from being returned by Credential Manager.
If you enable this policy setting, Credential Manager does not return a plaintext PIN.
If you disable or do not configure this policy setting, plaintext PINs can be returned by Credential Manager.
Note: Enabling this policy setting could prevent certain smart cards from working on Windows. Please consult your smart card manufacturer to find out whether you will be affected by this policy setting.
</string>
<string id="ForceReadingAllCertificates">Force the reading of all certificates from the smart card</string>
<string id="ForceReadingAllCertificates_help">This policy setting allows you to manage the reading of all certificates from the smart card for logon.
During logon Windows will by default only read the default certificate from the smart card unless it supports retrieval of all certificates in a single call. This setting forces Windows to read all the certificates from the card. This can introduce a significant performance decrease in certain situations. Please contact your smart card vendor to determine if your smart card and associated CSP supports the required behavior.
If you enable this setting, then Windows will attempt to read all certificates from the smart card regardless of the feature set of the CSP.
If you disable or do not configure this setting, Windows will only attempt to read the default certificate from those cards that do not support retrieval of all certificates in a single call. Certificates other than the default will not be available for logon.</string>
<string id="IntegratedUnblockPromptString">Display string when smart card is blocked</string>
<string id="IntegratedUnblockPromptString_help">This policy setting allows you to manage the displayed message when a smart card is blocked.
If you enable this policy setting, the specified message will be displayed to the user when the smart card is blocked. Note: The following policy setting must be enabled - Allow Integrated Unblock screen to be displayed at the time of logon.
If you disable or do not configure this policy setting, the default message will be displayed to the user when the smart card is blocked, if the integrated unblock feature is enabled.</string>
<string id="ReverseSubject">Reverse the subject name stored in a certificate when displaying</string>
<string id="ReverseSubject_help">This policy setting lets you reverse the subject name from how it is stored in the certificate when displaying it during logon.
By default the user principal name (UPN) is displayed in addition to the common name to help users distinguish one certificate from another. For example, if the certificate subject was CN=User1, OU=Users, DN=example, DN=com and had an UPN of user1@example.com then "User1" will be displayed along with "user1@example.com." If the UPN is not present then the entire subject name will be displayed. This setting controls the appearance of that subject name and might need to be adjusted per organization.
If you enable this policy setting or do not configure this setting, then the subject name will be reversed.
If you disable , the subject name will be displayed as it appears in the certificate.</string>
<string id="RootCertCleanupOption_1">Clean up certificates on smart card removal</string>
<string id="RootCertCleanupOption_2">Clean up certificates on log off</string>
<string id="SmartCard">Smart Card</string>
<string id="X509HintsNeeded">Allow user name hint</string>
<string id="X509HintsNeeded_help">This policy setting lets you determine whether an optional field will be displayed during logon and elevation that allows a user to enter his or her user name or user name and domain, thereby associating a certificate with that user.
If you enable this policy setting then an optional field that allows a user to enter their user name or user name and domain will be displayed.
If you disable or do not configure this policy setting, an optional field that allows a users to enter their user name or user name and domain will not be displayed.</string>
</stringTable>
<presentationTable>
<presentation id="CertPropRootCleanupString">
<dropdownList refId="RootCertCleanupOption_Levels" noSort="true" defaultItem="2">Root certificate clean up options</dropdownList>
</presentation>
<presentation id="IntegratedUnblockPromptString">
<textBox refId="IntegratedUnblockPromptString">
<label>Display string when smart card is blocked</label>
