tpmvscmgr
The tpmvscmgr command-line tool allows users with Administrative credentials to create and delete TPM virtual smart cards on a computer. Windows commands reference
On Windows 1 Sigma rule name it File tpmvscmgr.exe
Windows
tpmvscmgr create [/name] [/adminkey DEFAULT | PROMPT | RANDOM] [/PIN DEFAULT | PROMPT] [/PUK DEFAULT | PROMPT] [/generate] [/machine] [/?]tpmvscmgr destroy [/instance <instanceID>] [/?]To create a virtual smart card that can be later managed by a smart card management tool launched from another computer, type
tpmvscmgr.exe create /name VirtualSmartCardForCorpAccess /AdminKey DEFAULT /PIN PROMPTIdentify/nameRequired. Windows commands reference/AdminKeyIndicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN. Windows commands reference/PINIndicates desired user PIN value. Windows commands referenceTrips 1 Sigma rule: mediumNew Virtual Smart Card Created Via TpmVscMgr.EXE by Nasreddine Bencherchali (Nextron Systems)
Alternatively, instead of using a default administrator key, you can create an administrator key at the command line. The following command shows how to create an administrator key.
tpmvscmgr.exe create /name VirtualSmartCardForCorpAccess /AdminKey PROMPT /PIN PROMPTIdentify/nameRequired. Windows commands reference/AdminKeyIndicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN. Windows commands reference/PINIndicates desired user PIN value. Windows commands referenceTrips 1 Sigma rule: mediumNew Virtual Smart Card Created Via TpmVscMgr.EXE by Nasreddine Bencherchali (Nextron Systems)
To create an unmanaged virtual smart card that can be used to enroll certificates, type
tpmvscmgr.exe create /name VirtualSmartCardForCorpAccess /AdminKey RANDOM /PIN PROMPT /generateIdentify/nameRequired. Windows commands reference/AdminKeyIndicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN. Windows commands reference/PINIndicates desired user PIN value. Windows commands reference/generateGenerates the files in storage that are necessary for the virtual smart card to function. Windows commands referenceTrips 1 Sigma rule: mediumNew Virtual Smart Card Created Via TpmVscMgr.EXE by Nasreddine Bencherchali (Nextron Systems)
To delete the card, type
tpmvscmgr.exe destroy /instance <instance ID>Identify/instanceSpecifies the instance ID of the virtual smart card to be removed. Windows commands reference/nameRequired. Indicates the name of the new virtual smart card./adminkeyIndicates the desired administrator key that can be used to reset the PIN of the card if the user forgets the PIN. This can include:
- DEFAULT - Specifies the default value of *010203040506070801020304050607080102030405060708*.
- PROMPT - Prompts the user to enter a value for the administrator key.
- RANDOM - Results in a random setting for the administrator key for a card that is not returned to the user. This creates a card that might not be manageable by using smart card management tools. When using the RANDOM option, the administrator key must be entered as 48 hexadecimal characters./PINIndicates desired user PIN value.
- DEFAULT - Specifies the default PIN of 12345678.
- PROMPT - Prompts the user to enter a PIN at the command line. The PIN must be a minimum of eight characters, and it can contain numerals, characters, and special characters./PUKIndicates the desired PIN Unlock Key (PUK) value. The PUK value must be a minimum of eight characters, and it can contain numerals, characters, and special characters. If the parameter is omitted, the card is created without a PUK. The options include:
- DEFAULT - Specifies the default PUK of *12345678*.
- PROMPT - Prompts to the user to enter a PUK at the command line./generateGenerates the files in storage that are necessary for the virtual smart card to function. If you don't use the /generate parameter, it's like you created the card without the underlying file system. A card without a file system can be managed only by a smart card management system such as Microsoft Configuration Manager./machineAllows you to specify the name of a remote computer on which the virtual smart card can be created. This can be used in a domain environment only, and it relies on DCOM. For the command to succeed in creating a virtual smart card on a different computer, the user running this command must be a member in the local administrators group on the remote computer./?Displays Help for this command./instanceSpecifies the instance ID of the virtual smart card to be removed. The instanceID was generated as output by tpmvscmgr.exe when the card was created. The /instance parameter is a required field for the Destroy command.