SCARD_E_ICC_CREATEORDER (0x80100021) Fix

The 30-Second Fix: Check Your Card

Before you waste time on driver reinstalls or registry hacks — check the card itself. Pull it out, inspect the chip. Any visible scratches or bent contacts? If yes, replace the card. I've seen this error on cards that got bent in a wallet or sat too close to magnetic clasps.

Also try inserting the card into a different reader. If the error disappears, your original reader's hardware is flaky. If the error follows the card, it's the card or its applet.

Still there? Move on.

The 5-Minute Fix: Driver and Reader Reset

The culprit here is almost always a corrupted or incompatible reader driver. SCARD_E_ICC_CREATEORDER (0x80100021) fires when the reader's firmware or driver can't interpret the object creation order from the card's applet. Old drivers from 2015-2016 are notorious for this with newer Java Card 3.0.4 cards.

Step 1: Reset the Smart Card Service

Open Command Prompt as Administrator and run:

net stop scardsvr
net start scardsvr

Then try your operation again. Restarted the service in under 10 seconds. If the error's gone, you had a hung service — happens after a driver update or card removal without proper eject.

Step 2: Reinstall the Reader Driver

Open Device Manager. Find your smart card reader under "Smart card readers" or "Universal Serial Bus controllers". Right-click it, choose "Uninstall device". Check "Delete the driver software for this device" if it's an option — that's a checkbox on Windows 10 1803 and later. Then unplug the reader, wait 10 seconds, plug it back in. Windows will auto-reinstall the driver.

Still broken? Go to your reader manufacturer's site (Gemalto, Oberthur, ACS, etc.) and download the latest driver manually. Don't bother with Windows Update — it often serves generic drivers that lack vendor-specific fixes.

The 15+ Minute Fix: Card Applet or Card Reset

If the above didn't work, the card's applet is either corrupted or the card is in a bad state. This is where things get spicy. You'll need administrative access to the card — usually a GlobalPlatform key or a card management tool.

Step 1: Identify the Card's ATR

Use a tool like scardtool (from the Windows SDK) or a simple PowerShell script:

Get-WmiObject -Class Win32_SCardReader | Select-Object Name, Atr

Write down the 20-30 hex digit ATR. That tells you the card platform (e.g., Java Card 2.2.2 vs 3.0.4). If the ATR starts with 3B and contains 00 or 80, it's usually a Java Card.

Step 2: Reinstall the Applet

If you have the original applet file (.cap or .jar), use a GlobalPlatform tool like gp (open source, available on GitHub) to delete and reinstall it:

gp --delete 
gp --install myapplet.cap

If you don't have the applet, you're stuck. The card is bricked for your use case. Some readers support a full card reset via a proprietary command — check your reader's manual for "card initialization" or "erase all".

Step 3: Factory Reset the Card

This nukes everything on the card. Use GlobalPlatform's --default or --initialize flag:

gp --default

This sends a DELETE ALL command to the card's Issuer Security Domain. Only works if the ISD key hasn't been changed from default (often 404142434445464748494A4B4C4D4E4F). If it fails, the card is locked down — skip this card and get a new one.

What SCARD_E_ICC_CREATEORDER Actually Means

Under the hood, this error is sent by the reader's firmware when the host tries to create objects (like files or applets) on the card in an order the card doesn't support. For example, a Java Card might expect you to create the applet's directory first, then load the applet, then instantiate it — if you try to instantiate before loading, you get 0x80100021. The error code itself is part of the PC/SC spec, section 3.2.10. It's not a Windows bug — it's the reader echoing the card's refusal.

When to Give Up

If you've tried all three steps and still get the error, the card is physically or logically damaged. Smart cards have a limited write cycle — usually 100,000 to 500,000 writes. If this card has been reprogrammed many times, swap it. A new card costs $5-20. Your time is worth more than that.

One last thing: some cheap readers (under $10 from random brands) don't properly handle the CREATE ORDER command. They pass through the error instead of handling it gracefully. If your application works on an Identive or Gemalto reader but fails on a no-name USB dongle, that's your answer. Buy a proper reader.