The Prevent plaintext PINs from being returned by Credential Manager machine setting should be configured correctly. This policy setting prevents plaintext PINs from being returned by Credential Manager. If you enable this policy setting, Credential Manager does not return a plaintext PIN. If you disable or do not configure this policy setting, plaintext PINs can be returned by Credential Manager. Fix: (1) GPO: Computer Configuration\Administrative Templates\Windows Components\Smart Card\Prevent plaintext PINs from being returned by Credential Manager (2) KEY: HKLM\SOFTWARE\Policies\Microsoft\Windows\SmartCardCredentialProvider\DisallowPlaintextPin