Fix STATUS_SMARTCARD_SILENT_CONTEXT (0XC000038F)

Quick answer

Run your app with SECMANAGER_UI_CONSENT=1 or set HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Smart Card Reader\\SilentContext to 0. If it's a service, switch to interactive mode.

What's happening here

I've seen this error more times than I care to count — usually when someone remotes into a machine and tries to use a smart card for signing or auth. The culprit is almost always that the application grabbed the smart card context in silent mode. Windows smart card API calls need user interaction (PIN entry) by default, but if the app — or the service it's running under — sets the context to silent, you get 0XC000038F. No PIN prompt, no action.

Common trigger: You're using Remote Desktop, connect a smart card via RemoteFX or USB redirection, then launch an app. The app doesn't realize it needs to prompt, or it inherits a silent context from the RDP session. Another big one: services running as SYSTEM trying to use a smart card — they can't show a PIN prompt because there's no interactive user session.

Fix steps

1. Identify the app or service — Check Event Viewer under Windows Logs > Application for the provider name. Look for events with source Microsoft-Windows-Security-SPP or Smart Card.
2. Set the environment variable — Before launching your app, run in cmd or PowerShell:

   set SECMANAGER_UI_CONSENT=1

   For PowerShell:

   $env:SECMANAGER_UI_CONSENT = 1

   Then launch the app from the same session. This forces the provider to request interactive context.
3. Modify the registry for persistent fix — Open Regedit, go to

   HKLM\SOFTWARE\Microsoft\Cryptography\Defaults\Smart Card Reader\

   Find your reader's subkey (like HID Global OMNIKEY 5023 CL). Create a DWORD SilentContext and set it to 0. Restart the app. This tells the reader module to always ask for user consent.
4. For Remote Desktop — In your RDP file, make sure smart card redirection is enabled: redirectsmartcards:i:1. Also try running your app with /interactive switch if it's a console app.
5. For services — Change the service to run as your user account (not SYSTEM). Or, if it must run as SYSTEM, use Interactive Services Detection — but that's deprecated in Windows 10/11. Better: rewrite the service to prompt via a separate user-mode agent.

Alternative fixes if those don't work

• Update smart card reader drivers — Old drivers sometimes mishandle context flags. Grab the latest from the vendor's site, not Windows Update.
• Check Group Policy — Navigate to Computer Configuration > Administrative Templates > System > Smart Card. Look for Allow smart card silent context. If it's enabled, it forces silent mode regardless of app requests. Set it to Disabled or Not Configured.
• Use a different smart card middleware — If you're using the Microsoft base CSP, try switching to the vendor's own CSP or PKCS#11 provider. Some middleware handles context negotiation better.
• Disable credential manager interference — In some odd cases, Windows Credential Manager caches smart card PINs and then tries to use them silently. Clearing cached credentials under Control Panel > Credential Manager > Windows Credentials can force a fresh prompt.

Prevention tip

Once you've fixed it, document your app's context handling. Most devs don't test for silent context — they assume the user will get a PIN prompt. If you're writing or maintaining an app that uses smart cards, call SCardEstablishContext with SCARD_SCOPE_USER explicitly, and handle SCARD_E_SILENT_CONTEXT by prompting the user to relaunch interactively. That simple check saves hours of head-scratching later.

Side note: If you're running this in a terminal server environment with hundreds of users, batch-creating the registry key for each reader via Group Policy Preferences is your friend. Saves you from touching every machine.