Fix 0xC0000385 STATUS_SMARTCARD_NO_CERTIFICATE

You plug in a PIV or CAC card, Windows prompts for the PIN, and then bam: STATUS_SMARTCARD_NO_CERTIFICATE (0XC0000385). The logon screen just sits there, or the VPN client closes with that hex code in the event log. It happens most often right after a card reissue, a certificate renewal, or when a user tries to log into a machine that's never seen that card before. I've seen it on Windows 10 22H2 and Windows 11 23H2 more than anything else, and it almost always traces back to the same handful of things.

What 0xC0000385 actually means

Windows is asking the card, "give me a certificate I can use for logon." The card answers, in effect, "there isn't one." That's it. The error is not about the PIN. It's not about the reader. It's about the certificate that Windows expects to find on the card and can't.

The culprit here is almost always one of these: the logon certificate was never written to the card, the certificate template is wrong (no Smart Card Logon EKU), the card's minidriver isn't installed so Windows can't read the cert store, or the certificate propagation service hasn't refreshed its cache. Sometimes it's the card itself — a bogus PIV applet or a card that got wiped during reissue.

Fix it — in order

See what's actually on the card. Open an elevated command prompt and run:
```
certutil -scinfo
```
It'll prompt for the PIN and dump every cert it can read off the card. If the list is empty, or the only certs are for email or signing, you've confirmed the problem — there's no Smart Card Logon cert. If certutil itself errors out, jump to step 4.
Check the EKU on the cert. If certutil shows a cert but logon still fails, look at the Extended Key Usage. It must include Smart Card Logon (1.3.6.1.4.1.311.20.2.2). A cert with only Client Authentication (1.3.6.1.5.5.7.3.2) won't cut it for interactive logon. On the CA, open the template and confirm the EKU is set. If it's missing, fix the template, re-enroll, and reissue the card.
Re-enroll the certificate onto the card. On the issuing workstation, open the Certificates MMC (certmgr.msc), find the Smart Card Logon template in Personal → Certificates, right-click → All Tasks → Request New Certificate. Pick the smart card logon template. It'll ask for the card and PIN. If the wizard says "no smart card found" or the request fails, the card is probably blank or the minidriver isn't loaded — see step 4.
Confirm the minidriver is installed. Windows ships with a generic PIV minidriver, but a lot of vendor cards need their own. Check Device Manager → Smart card readers and Smart cards. If the card shows up with a yellow bang or as "Microsoft Usbccid Smartcard Reader" with no matching smart card device beneath it, install the vendor minidriver (YubiKey PIV, Gemalto, IDEMIA, etc.). Then re-run certutil -scinfo.
Restart the Certificate Propagation service. I know it sounds like voodoo, but this service is what feeds the card's certs into the user's profile and the logon provider. If it's stopped or hung, Windows will claim there's no cert even when there is. Run:
```
net stop certprop
net start certprop
```
Or bounce it from services.msc. Set it to Automatic (Delayed Start) if it's been disabled — I've found it disabled by overzealous GPOs more than once.
Clear the cached certs and replug the card. Pull the card, wait five seconds, plug it back in. If you're on a shared workstation, log out first. The cert cache lives per-session and stale entries from a previous user can shadow the new one.

If it still fails

Start narrowing it down from the outside in.

Try the card on a different machine. If it fails there too, the problem is the card or the cert on it. If it works, the problem is the workstation.
Check the event log. Application and System logs, filter for source SmartCard or CertificateServicesClient. Look for 0xC0000385 or 0x8010006E (SCARD_E_NO_CERTIFICATE). Timestamps tell you whether it's happening at logon, at unlock, or when a specific app requests the cert.
Verify the CA's template. On the issuing CA, open certsrv.msc → Certificate Templates. The Smart Card Logon template needs: Smart Card Logon EKU, "Prompt the user during enrollment" checked, and the correct CSP/minidriver under the Request Handling tab. Get this wrong and every card you issue is dead on arrival.
Don't bother re-importing the cert into the user's store. It rarely helps. The logon provider reads from the card, not the user profile.
If the card is a PIV and you've got a blank card, you may need to initialize it with the vendor's tool (ykman, piv-tool, Gemalto minidriver utility) before any cert can be enrolled. A factory-blank PIV has no cert slots populated — Windows will happily report 0xC0000385 until you put something there.

Nine times out of ten, re-running certutil -scinfo tells you exactly which of these it is. If the cert isn't on the card, no amount of Windows-side fiddling will fix it. Get the cert on the card first, then worry about the rest.