Windows 11 CAC Setup

Windows 11 introduced several changes to how smart cards and CAC readers work. This guide walks through setting up your CAC reader on Windows 11, from driver installation to browser configuration and troubleshooting common issues specific to this operating system.

Before You Start

Gather these items before beginning setup:

• Your CAC (Common Access Card)
• A compatible CAC reader (USB)
• Your CAC PIN
• Administrator access to your computer (for driver installation)

If you’re setting up a government-furnished computer, your IT department may have pre-installed necessary drivers and middleware. Check with them before making changes.

Step 1: Connect Your CAC Reader

Plug your CAC reader into a USB port directly on your computer. Avoid USB hubs for initial setup—they can cause detection issues. Windows 11 should automatically detect the reader and attempt to install drivers.

Wait 30-60 seconds for Windows to finish driver installation. You’ll see a notification in the system tray when the device is ready.

Step 2: Verify Reader Detection

Confirm Windows recognizes your reader:

1. Right-click the Start button
2. Select “Device Manager”
3. Expand “Smart card readers”
4. Your reader should appear without yellow warning icons

If you see a yellow triangle, right-click the device and select “Update driver.” Choose “Search automatically” to find the correct driver.

Step 3: Verify Smart Card Services

Windows 11 requires certain services running for CAC authentication:

1. Press Windows + R, type services.msc, press Enter
2. Find and verify these services are set to “Automatic” and “Running”:
   • Smart Card
   • Smart Card Device Enumeration Service
   • Certificate Propagation
3. If any are stopped, right-click and select “Start”
4. If Startup Type isn’t “Automatic,” right-click > Properties > change it

Step 4: Install DoD Certificates

Your computer needs DoD root certificates to trust your CAC:

1. Visit DISA’s PKI/PKE page
2. Download the latest “DoD PKE InstallRoot” package for Windows
3. Run the installer as Administrator
4. Follow the prompts to install all certificates
5. Restart your computer when complete

Step 5: Install ActivClient or Middleware

Most organizations require ActivClient or similar middleware:

1. Download the approved version from your organization’s software portal
2. Run the installer as Administrator
3. Choose “Typical” installation unless IT specifies otherwise
4. Restart when prompted

Note: Windows 11 has built-in smart card support that works for basic functions, but ActivClient provides additional features many DoD sites require.

Step 6: Configure Your Browser

Microsoft Edge (Recommended for DoD Sites)

Edge uses Windows certificate stores automatically. After installing DoD certificates:

1. Insert your CAC
2. Navigate to a DoD website requiring CAC authentication
3. When prompted, select your certificate and enter your PIN

Google Chrome

Chrome also uses Windows certificate stores. Configuration is similar to Edge:

1. Go to Settings > Privacy and security > Security
2. Click “Manage certificates”
3. With your CAC inserted, your DoD certificates should appear in the Personal tab

Mozilla Firefox

Firefox requires additional configuration:

1. Open Firefox and go to Settings > Privacy & Security
2. Scroll to “Security Devices” and click it
3. Click “Load”
4. Enter a module name like “CAC Module”
5. Browse to the ActivClient module file (typically C:\Program Files\ActivIdentity\ActivClient\acpkcs211.dll)
6. Click OK and restart Firefox

Step 7: Test Your Setup

Verify everything works by visiting a CAC-enabled site:

• MilConnect – Tests basic CAC authentication
• OWA Mail – Tests email certificate access

When prompted, select the appropriate certificate (usually your email certificate) and enter your PIN.

Windows 11 Specific Issues and Fixes

Reader Not Detected After Windows Update

Some Windows 11 updates reset smart card settings:

1. Open Device Manager
2. Right-click your reader under “Smart card readers”
3. Select “Uninstall device”
4. Unplug and replug the reader
5. Let Windows reinstall drivers

“No Valid Certificates Found” Error

This often means the middleware isn’t communicating with Windows 11 properly:

1. Open ActivClient (or your middleware)
2. Go to Tools > Advanced > Card and Reader Diagnostics
3. Run the diagnostic to verify card communication
4. If diagnostics fail, reinstall the middleware

PIN Prompt Doesn’t Appear

Windows 11’s credential guard can interfere with CAC prompts:

1. Check that your organization hasn’t enabled settings that block smart card PIN entry
2. Try accessing the site in a private/incognito window
3. Clear browser cache and cookies

Card Works in Some Apps But Not Others

Different applications may use different certificate stores:

• Windows applications use the Windows certificate store
• Firefox uses its own store (requires separate configuration)
• Some Java applications need their own keystore configuration

Keeping Your Setup Working

Maintain your Windows 11 CAC setup with these practices:

• Install Windows updates regularly—they often include smart card security fixes
• Update ActivClient when new versions are released through your organization
• Re-download DoD certificates every 6-12 months as they’re updated
• Restart your computer after any Windows feature update
• Keep your CAC reader drivers current