Help › In the session › E24

Use your own smart card at a Windows device

Your signature card or company ID card sits in the card reader on your side. In the session you pass the card on — at the Windows device it then sits in “BrowserDesk Kartenleser 0”, and every program there can use it.

Preview this guide has not yet been clicked through on a real device. Button names and steps come from the program but may differ in details.

For: Technician
Applies to: Cloud · Own relay
Licence: usbredirect
Right in the console: Device redirection (deviceRedirect)
Controlled device: Windows
Control from: Program (Windows, macOS, Linux)
from version: 20261011.21

What it is for

You have to do something at the customer's computer with your smart card — a signature, a sign-in with your company ID card. The card sits in the card reader on your side. In the session you pass it on: at the Windows device a card reader "BrowserDesk Kartenleser 0" appears with your card, and programs there use it as if it were plugged in there. The card itself stays with you; only card commands and answers travel over the line.

What you need

Licence feature usbredirect: included in paid Cloud; with an own relay, with a licence for USB redirection. Never with Free.
The "device redirection" right at the device. It is off by default. Only an administrator switches it on in the console: the device's settings → Access and permissions → Device redirection (technician's smart card).
At the device: Windows on a 64-bit processor (x64), with the BrowserDesk service installed (C4), in a signed-in user session. Not on Windows Server, ARM64 or in S mode.
On your side: the BrowserDesk program on a computer and a card reader with your card.
In the session: you control the device. It does not work in a control-room tile.

How to do it

Put the card into your card reader.
In the session choose DateienSmartcard weiterreichen … (Files > Pass on smart card …).
The window Smartcard weiterreichen (Pass on smart card) lists your readers with their state, for example Karte steckt (card inserted). If one is missing: connect the reader, Neu einlesen (Rescan).
Choose the reader and click Weiterreichen (Pass on). "Smartcard wird am Gerät eingesteckt …" (inserting the smart card at the device …) appears. The first time, the service sets up the card reader at the device; this takes a few seconds.
Work with the card at the device. The PIN is entered at the device.
Done? DateienSmartcard zurückholen (Files > Take back smart card) or Zurückholen (Take back) in the display at the bottom left.

How you know it worked

At the bottom left on your side a display in warning colour shows the number of accesses and Zurückholen.
At the device the certificate picker or the signature software recognises the card in "BrowserDesk Kartenleser 0".

What the other side sees

On Windows a window appears at the bottom right: "Smartcard von … steckt im „BrowserDesk Kartenleser 0“." (smart card of … is in BrowserDesk card reader 0) with Beenden (Stop). BrowserDesk does not ask for consent at the device for this — that is what the "device redirection" right is for.

Good to know

The card is locked on your side while it is passed on — other programs on your computer cannot reach it.
PIN at the device: you type the PIN on the customer device's keyboard. Only pass the card on to trustworthy devices. Readers with their own keypad (pinpad) are not passed through.
Pulling and inserting on your side arrives at the device: card pulled = card pulled at the device.
End: when you take it back, with Beenden at the device, at the end of the session, after 10 minutes without card access, and when control or the right goes away. Your card is reset then — a PIN verified at the device does not stay open.
The card reader stays set up at the device but switched off; no program sees it then. To remove it completely: Kartenleser vom Gerät entfernen (Remove card reader from the device) in the window Smartcard weiterreichen (only while no card is passed on).
Nothing is recorded: BrowserDesk does not log card contents, only reader, direction and the number of accesses.
When the card reader is set up, Windows trusts the publisher ondeso only for that one step.

If it does not work

You see	Meaning and fix
"Das Recht „Geräte umleiten“ ist an diesem Gerät aus (Konsole → Geräte-Einstellungen)." (the device redirection right is off)	Ask the administrator to switch on Device redirection (technician's smart card) for the device.
"Nur mit installiertem BrowserDesk-Dienst — der Kartenleser wird mit Administratorrechten eingerichtet." (only with the service installed)	Set up the service at the device (C4).
"Eine Smartcard des Technikers kann bisher nur an Windows-Geräten stecken." (only on Windows devices)	The device is a Mac or Linux computer.
"Auf Windows Server nicht freigegeben (der Kartenleser ist nicht von Microsoft signiert)." (not on Windows Server)	It does not work on Windows Server.
"Nur auf 64-Bit-Windows (x64) — für ARM64 bräuchte der Kartenleser eine Signatur von Microsoft." (only x64)	ARM devices are not supported.
"Im S-Modus lässt Windows nur von Microsoft signierte Treiber zu." (S mode)	Windows in S mode is not supported.
"Nur in einer angemeldeten Benutzersitzung (nicht am Sperr- oder Anmeldebildschirm)." (only in a signed-in session)	Sign in or unlock at the device first.
"Kein Kartenleser gefunden. Leser anschließen und „Neu einlesen“." (no card reader found)	No reader is connected on your side.
Karte steckt (antwortet nicht) (card inserted, not responding)	The card does not answer. Re-insert it, then Neu einlesen.
"Am Gerät steckt schon eine Smartcard eines Technikers." (a technician's smart card is already in)	Take the other card back first.
"BrowserDesk am Gerät aktualisieren — diese Fassung kennt das Weiterreichen einer Smartcard nicht." (update BrowserDesk at the device)	The device runs a version before 20261011.21.

← Open a drive of the device at the technician's side — with consent at the device Give a computer without a screen a virtual monitor →