[REQ-DC-059] Disable Smart Card Device Enumeration Service on Domain Controllers (ScDeviceEnum)

Target Scope

Applicable Systems: Domain Controllers (DCs) running Windows Server.
Operating Systems: Windows Server 2016, Windows Server 2019, Windows Server 2022.

Implementation Details

Priority: Medium
GPO Path / Registry Location:
- GPO Path: Computer Configuration\Preferences\Windows Settings\Registry
- Registry Location: HKLM\SYSTEM\CurrentControlSet\Services\ScDeviceEnum\Start

Rationale

Domain Controllers represent the highest privilege tier (Tier 0) in the Active Directory forest. Minimizing the execution footprint on these critical servers is an essential hardening guideline. Disabling the Smart Card Device Enumeration Service (ScDeviceEnum) service directly supports this:

Detects smart cards; can be disabled if smart cards are not used for authentication.
Reducing running background services closes potential vectors for local privilege escalation and memory space exploits on the directory controllers.

Legacy Impact & Compatibility

Normal Operations: Disabling this service has no impact on core Active Directory Domain Services (AD DS), Kerberos, DNS, or SYSVOL replication functionality.
Special Hardware/Configurations: Smart card services or time sync should remain enabled if strictly required, but the services listed in the baseline can be safely disabled on standard directory servers.

Implementation Steps

Option A: Group Policy Object (GPO) Configuration (Preferred)

Because these services are not managed through standard GPO Administrative Templates, configure Group Policy Preferences (GPP) for the registry:

Open the Group Policy Management Console (gpmc.msc) on a domain management host.
Edit the GPO linked to your Domain Controllers Organizational Unit (e.g., GPO_Hardening_DomainControllers).
Navigate to: Computer Configuration\Preferences\Windows Settings\Registry
Create a new Registry Preference (Right-click Registry -> New -> Registry Item):
- Action: Update
- Hive: HKEY_LOCAL_MACHINE
- Key Path: SYSTEM\CurrentControlSet\Services\ScDeviceEnum
- Value name: Start
- Value type: REG_DWORD
- Value data: 4

Option B: PowerShell & Registry Configuration (Remediation / Non-GPO)

Download Script: Configure-DisableScDeviceEnum.ps1

# Configure-DisableScDeviceEnum.ps1
# Description: Disables the unnecessary Smart Card Device Enumeration Service (ScDeviceEnum) service on Domain Controllers.

Write-Host "Applying hardening requirement: Disable Smart Card Device Enumeration Service service on Domain Controllers..." -ForegroundColor Cyan

$ServiceName = "ScDeviceEnum"
$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)"

$Service = Get-Service -Name $ServiceName -ErrorAction SilentlyContinue
if ($null -ne $Service) {
    if ($Service.StartType -ne "Disabled") {
        if ($Service.Status -eq "Running") {
            Stop-Service -Name $ServiceName -Force -ErrorAction SilentlyContinue | Out-Null
        }
        Set-Service -Name $ServiceName -StartupType Disabled -ErrorAction SilentlyContinue | Out-Null
        Write-Host "[+] Service '$($ServiceName)' stopped and disabled." -ForegroundColor Green
    } else {
        Write-Host "[~] Service '$($ServiceName)' is already disabled." -ForegroundColor Gray
    }
} else {
    Write-Host "[~] Service '$($ServiceName)' is not installed." -ForegroundColor Gray
}

if (Test-Path -Path $RegPath) {
    Set-ItemProperty -Path $RegPath -Name "Start" -Value 4 -Type DWord -ErrorAction SilentlyContinue | Out-Null
    Write-Host "[+] Registry Start value set to 4 (Disabled) for service '$($ServiceName)'." -ForegroundColor Green
}

To verify the startup type of this unnecessary service on the Domain Controller:

Download Script: Get-ScDeviceEnumStatus.ps1

# Get-ScDeviceEnumStatus.ps1
# Description: Audits the registry startup state of unnecessary Smart Card Device Enumeration Service (ScDeviceEnum) service.

Write-Host "--- Auditing Smart Card Device Enumeration Service (ScDeviceEnum) Service on Domain Controller ---" -ForegroundColor Cyan

$ServiceName = "ScDeviceEnum"
$RegPath = "HKLM:\SYSTEM\CurrentControlSet\Services\$($ServiceName)"
$IsVulnerable = $false

if (Test-Path -Path $RegPath) {
    $StartVal = Get-ItemProperty -Path $RegPath -Name "Start" -ErrorAction SilentlyContinue
    if ($null -ne $StartVal) {
        $Start = $StartVal.Start
        if ($Start -eq 4) {
            Write-Host "[+] Service '$($ServiceName)' is secure (Disabled)." -ForegroundColor Green
        } else {
            Write-Host "[!] VULNERABLE: Service '$($ServiceName)' startup type is not Disabled (Start value is $($Start))." -ForegroundColor Red
            $IsVulnerable = $true
        }
    } else {
        Write-Host "[!] VULNERABLE: Service '$($ServiceName)' exists but Start registry value is missing." -ForegroundColor Red
        $IsVulnerable = $true
    }
} else {
    Write-Host "[+] Service '$($ServiceName)' is not installed (Secure)." -ForegroundColor Green
}

if ($IsVulnerable) {
    Write-Host "Audit Result: VULNERABLE" -ForegroundColor Red
    exit 1
} else {
    Write-Host "Audit Result: SECURE" -ForegroundColor Green
    exit 0
}

Sources & Compliance References

Microsoft Windows Server Security Guidance: Guidelines for disabling system services in Windows Server
ANSSI AD Hardening Guide: Recommendation R4 (Minimization of service execution)
CIS Microsoft Windows Server Benchmark: Service minimization baselines

REQ-DC-059 - Disable Smart Card Device Enumeration Service (ScDeviceEnum)