Administrative Template (ADMX) for YubiKey Smart Card Minidriver

Introduction

This ADMX administrative template allows administrators to easily deploy configuration of the YubiKey Smart Card Minidriver through Active Directory Group Policy or Microsoft Intune. It can also be used on standalone computers to unlock some features of the YubiKey Minidriver that are disabled by default, like controlling the touch policy or blocking the generation of unsafe keys (ROCA).

Screenshots

Available Settings

These are the YubiKey Minidriver settings that can currently be configured, with their default values highlighted:

Configure touch policy for new keys
- Never
- Always
- Cached
Enable ROCA mitigation
Enable debug logging
- Debug log verbosity
  - Level 0 - Card module methods only
  - Level 1 - Errors and warnings
  - Level 2 - Informational
  - Level 3 - Full APDU tracing
Block PUK on Management Key upgrade
Disable automatic BaseCSP cache management
Enable card management key
Configure device key refresh
- 300 seconds
Disable support for the Always Prompt PIN
Disable automatic fingerprint prompt
Configure User PIN cache policy
- Normal
- Timed
- None
- Always prompt
Configure External PIN cache policy
- Normal
- Timed
- None
- Always prompt
Configure PIN cache timeout
- 60 seconds

The settings are on par with the 4.6.3.252 version of the Minidriver, released on May 21, 2024. Note that some settings are only applicable to devices that support slot metadata (YubiKey 5.2.7+).

Installation

Just copy the ADMX and ADML files into the local or central ADMX store.

Localization

Thanks to the awesome open-source community, the template has been translated into the following languages:

English
French
Italian

If you want to contribute with a new localization, you can create a language-specific copy of the en-US ADML file.

References

The ADMX template is based on the following official document:

Deploying the YubiKey Minidriver to Workstations and Servers