Windows 11 CAC Setup Guide (2025)

Windows 11 and Your CAC Card

Windows 11 brought significant changes to how the operating system handles smart cards and security certificates. Many service members upgrading from Windows 10 encounter unexpected CAC reader issues. This guide walks you through setting up your CAC reader correctly on Windows 11.

Before You Start

Gather these items before beginning the setup process:

• A working CAC card with valid certificates
• USB CAC reader (USB-C adapter if needed for newer laptops)
• Administrator access to your computer
• Stable internet connection for downloading certificates

Step 1: Connect Your CAC Reader

Plug your CAC reader into a USB port. Windows 11 typically recognizes common readers like SCR3310 and Identiv automatically. Check Device Manager to confirm detection. Look under “Smart card readers” for your device.

If the reader doesn’t appear, try a different USB port. USB 2.0 ports (black inside) work more reliably than USB 3.0 ports with older readers.

Step 2: Install DoD Certificates

Windows 11 requires the latest DoD root certificates for CAC authentication. Download the certificate bundle from the official DoD PKI website at cyber.mil.

Run the InstallRoot installer with administrator privileges. The installer adds all necessary root and intermediate certificates to your Windows certificate store.

Step 3: Configure Smart Card Service

Windows 11 sometimes disables the Smart Card service by default. Open Services (services.msc) and locate “Smart Card.” Set the startup type to “Automatic” and start the service if it’s stopped.

Also verify “Smart Card Device Enumeration Service” and “Certificate Propagation” services are running.

Step 4: Configure Your Browser

Edge and Chrome use the Windows certificate store directly. Firefox requires additional configuration to access your CAC certificates. Open Firefox settings, search for “certificates,” and enable “Query PKCS#11 devices.”

Step 5: Test Your Setup

Insert your CAC card and navigate to a CAC-enabled site like MyPay or DFAS. Enter your PIN when prompted. If certificates display correctly and you can authenticate, your setup is complete.

Common Windows 11 Issues

Reader works but no certificates appear: Reinstall DoD certificates and restart your browser.

PIN prompt doesn’t appear: Check that Smart Card service is running and restart it.

Certificate errors despite valid CAC: Clear your browser’s certificate cache and retry.

Windows 11 Specific Settings

Windows 11 introduced a new security feature that can interfere with CAC readers. If you experience random disconnections, disable “Enhanced Sign-in Security” in Settings > Accounts > Sign-in options.

Some users report issues with Windows Hello conflicting with CAC authentication. Temporarily disable Windows Hello if you encounter certificate selection problems.