Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Is it possible to implement a Hardware Security Token into the authentication process to log in to Windows 7?

I want the computer to reject the correct log in information (Username/Password) unless the Hardware Security Token (READ: USB device containing the token) is connected to the computer.

I am researching different forms of protection for a fairly pricey rig that is going to be built.

The computer should essentially be a brick unless the correct username and password are entered and the authenticator has plugged in the token.

share|improve this question
A hardware security token will not stop someone from accessing the local machine if they can still touch it / take the side panels off. – Darth Android Jul 19 '13 at 17:38
I was talking moreso about the data on the harddrive, apologies for being unclear. – Kain Jul 19 '13 at 17:42
For a home system I would recommend getting a Yubikey. They're only $30. – flashnode Jul 19 '13 at 17:55
Unless you encrypt the data they can pull the hdd and read the data on the hdd but yes Windows support certificate based authentication out of the box – Ramhound Jul 19 '13 at 23:26

It is definitely possible and is already widely used in practice. What you're looking for is a USB token that authenticates the PC when it is plugged in. Whereby the PC can only be accessed with the token. There are two software applications that support this.

  1. Truecrypt - Truecrypt encrypts the entire PC and requires a password at boot startup. This can be extended to also requiring a USB token to be able to access the contents of the PC. Encryption is done on-the-fly which means you will barely notice it at all and it behaves just like a regular PC once the correct keys are entered.

  2. Microsoft BitLocker Drive Encryption - Bitlocker is a default program that is available in several versions of windows. This means no additional software needs to be installed. It works in the same kind of way as Truecrypt. However it requires a dedicated TPM chip to process the encryption keys which only some motherboards support.

Here's a link which explains things in more detail:

BitLocker is able to meet all your required needs. I recommend using it over Truecrypt as it is already a standard feature of later versions of Windows.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.