How to Create and Manage TPM Virtual Smart Cards in Windows 11 Using tpmvscmgr

Hardware smart cards provide robust two-factor authentication (2FA) for enterprise environments, remote desktop gateways, and secure code signing. However, provisioning physical smart card readers and distributing plastic cards incurs significant administrative overhead and equipment costs. To address this challenge, Windows 11 and Windows 10 feature native support for Virtual Smart Cards (VSC).

Using the built-in TPM Virtual Smart Card Manager (tpmvscmgr.exe), administrators and power users can emulate physical smart cards by binding cryptographic keys directly to the onboard Trusted Platform Module (TPM 2.0) chip. This provides the security of hardware-backed multi-factor authentication without requiring external card readers.

Verifying TPM 2.0 and Smart Card Service Status

Before creating a virtual smart card, verify that your machine has an active, operational TPM 2.0 module. Open PowerShell as an Administrator and execute:

Get-Tpm

Confirm that both TpmPresent and TpmReady return True.

Next, ensure the Windows Smart Card service (SCardSvr) is active and configured for automatic startup:

Get-Service -Name SCardSvr | Set-Service -StartupType Automatic -PassThru | Start-Service

Creating a TPM Virtual Smart Card Using tpmvscmgr

The tpmvscmgr.exe utility creates the virtual card reader device and allocates a secure cryptographic container inside the TPM. Open an elevated Command Prompt or PowerShell terminal and run:

tpmvscmgr.exe create /name "CorpVSC" /AdminKey DEFAULT /PIN PROMPT /PUK PROMPT /generate

Parameter Breakdown:

• create: Initializes a new virtual smart card instance.
• /name "CorpVSC": Assigns a descriptive friendly name to the virtual reader.
• /AdminKey DEFAULT: Sets the default challenge-response administrator key used for certificate management.
• /PIN PROMPT: Prompts you in the terminal to define a user PIN (minimum 8 alphanumeric characters).
• /PUK PROMPT: Prompts for a PIN Unblocking Key (PUK) to allow recovery if the PIN is entered incorrectly multiple times.
• /generate: Automatically generates the required filesystem layout and cryptographic metadata on the card.

Upon completion, the utility outputs the newly assigned device instance path (e.g., ROOT\SMARTCARDREADER\0000).

Auditing Active Virtual Smart Card Readers

Verify that Windows recognizes the new virtual hardware reader:

Get-PnpDevice -Class "SmartCardReader" | Select-Object FriendlyName, Status, InstanceId

You can also interrogate the virtual card using the Windows certificate utility:

certutil -scinfo

The utility should detect the virtual card, verify the cryptographic service provider (Microsoft Base Smart Card Crypto Provider), and report that the card is ready for certificate enrollment.

Enrolling Certificates onto the Virtual Smart Card

Once provisioned, the virtual smart card functions identically to a physical smart card:

1. Press Windows + R, type certmgr.msc, and press Enter to open the User Certificates console.
2. Right-click Personal > Certificates and select All Tasks > Request New Certificate.
3. Select an enterprise certificate template configured for Smart Card Logon or Client Authentication.
4. When prompted, select the Microsoft Base Smart Card Crypto Provider and enter your smart card PIN.

The private key is generated directly within the TPM chip and cannot be extracted or exported in plain text.

Destroying and Removing a Virtual Smart Card

When decommissioning a workstation, rotating credentials, or testing deployments, destroy the virtual smart card using its device instance ID:

# Retrieve the device instance ID
$device = Get-PnpDevice -Class "SmartCardReader" | Where-Object { $_.FriendlyName -like "*Virtual Smart Card*" }

# Destroy the virtual card container
tpmvscmgr.exe destroy /instance $device.InstanceId

This command deletes the virtual reader from Device Manager, clears the associated TPM storage keys, and invalidates enrolled certificates.