The Microsoft Smart Card Resource Manager is not running.

[redflitzi]

I got a problem on a GitHub Windows-Runner 2022.

I designed a workflow that includes software signing via a USB smartcard (Certum).
The smartcard with the certificate is made available using a VirtualHere client.
For non-interactive signing I use SCSigntool which accepts the password as a parameter.

This approach works on two different desktop Windows 10 PCs.

But via workflow on the Windows-latest runner, it fails.
All critical info reside in repository secrets.
The USB smartcard is already visible and can be made available ("use") in VirtuaHere.
But then it seems as if there is a missing service for the smartcard. But which one is it?

I did (in the workflow):

Set-Service SCardSvr -StartupType Manual
net start SCardSvr
Set-Service ScDeviceEnum -StartupType Manual
net start ScDeviceEnum

I got:

The Smart Card service is starting.
The Smart Card service was started successfully.

The Smart Card Device Enumeration Service service is starting.
The Smart Card Device Enumeration Service service was started successfully.

and then follows

CertUtil -SCInfo

But then it errors with

The Microsoft Smart Card Resource Manager is not running.
WaitForSingleObject: Service is in an unknown state.
CertUtil: -SCInfo command FAILED: 0x80070102 (WIN32/HTTP: 258 WAIT_TIMEOUT)
CertUtil: The wait operation timed out.

Is there anything else that might be missing, can be checked, or done?
Perhaps some system parts or drivers that are generally missing in the runners?
Thank you very much!

[KevinLPiatt]

You will also need to start the Smart Card Removal Policy (net start SCPolicySvc). If that service starts and then immediately stops then either a local or group policy has the smart card removal behavior set to "no action" in its settings. You can update the local group policy or your domain's group policy as applicable.

Local:
Computer Configuration > Windows Settings > Security Settings > Local Policies > Security Options / Interactive logon: Smart card removal behvior (select any option other than "no action")

GPO:
Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options / Interactive logon: Smart card removal behvior (select any option other than "no action")