One NFC card can be linked to several Active Directory accounts in CodeB Credential Provider V2. When the card is tapped, CodeB uses the account whose Windows “Log On To” list names this computer; otherwise the only account without such a list; otherwise it shows an account picker on the logon screen. Users with one card on four or five accounts need no separate PIN per account.
What does “one card, several accounts” do?
A single NFC card can be linked to several Active Directory accounts — for example the card owner’s own account, a lab account used only on one PC, and a shared-lab account used only on one server. CodeB Credential Provider V2 then decides at each computer which of these accounts the card logs on to, using the standard Windows / AD setting “Log On To” (attribute userWorkstations). Windows enforces the same setting, so the CodeB choice and the Windows logon rule never contradict each other.
- Mode: Active Directory card linking (cards stored in AD).
- Configured in: CodeB Admin Console,
CodeBAdminCLI.exe, or Active Directory Users and Computers. - Defaults: account picker on, fallback account on.
- Applies to: CodeB SmartLogin beta of 10 November 2026 and later.
How does CodeB choose the account when the card is tapped?
- The card is linked to one account only: that account is used, as before.
- It is linked to several accounts: the account whose “Log On To” list names this computer is used.
- No account names this computer: the only account without a “Log On To” list is used. Such an account may log on everywhere (the “fallback account”).
- Otherwise the logon screen shows the account picker and the user chooses.
Example: a card linked to DOMAIN\anthony.traher (no restriction), DOMAIN\labuser1 (Log On To: LabPC1) and DOMAIN\labuser2 (Log On To: SHAREDLAB).
| Computer | Account used |
|---|---|
| LabPC1 | labuser1 |
| SHAREDLAB | labuser2 |
| Any other PC | anthony.traher |
How do you link one card to several accounts?
- Link the card to each account in Active Directory: CodeB Admin Console, tab Active Directory cards → Add card…, or
CodeBAdminCLI.exe /add2fa//add2ad. The warning “card is already linked to …” is expected here — confirm it. - Set “Log On To” for the accounts that belong to specific computers, in one of three ways:
- CodeB Admin Console: select the account’s row → Log On To… → enter the computer names, comma separated (for example
LabPC1). Leave the list empty for “all computers”. The column Log On To shows the current value. - Command line:
CodeBAdminCLI.exe /user DOMAIN\labuser1 /logonto LabPC1. Use/logonto *to allow all computers again and/showlogontoto display the setting. - Active Directory Users and Computers: account → Account tab → Log On To….
- CodeB Admin Console: select the account’s row → Log On To… → enter the computer names, comma separated (for example
- Use the computer’s NetBIOS name — the name Windows shows as the computer name, for example
LabPC1. The full DNS name is accepted as well.
How does the account picker work at the logon screen?
When the card may log on to several accounts on this computer and rules 2 and 3 do not decide, CodeB Credential Provider V2 does not guess:
- The tap selects the “Other user” tile, which shows a list “Account” with all accounts of the card that may log on to this computer. Accounts limited to other computers by “Log On To” are not listed.
- Nothing is logged on automatically. The user picks the account and presses Enter.
- If the card also carries a stored logon (for example card logon with the default PIN), that account is preselected — tap and Enter logs on as before.
- For any other account CodeB uses that account’s own card logon stored in Active Directory (card, or card + PIN). If there is none, the user types the password of the selected account.
- CodeB never logs on as a different account than the one selected. Without a stored logon and without a password the screen says: “The card has no stored logon for the selected account. Enter the password of the selected account.”
- NFC cards are often only tapped, so the list stays open after the card is removed. Tap once more to use the card’s stored logon; the chosen account stays selected. The list closes 5 minutes after the last tap, or when another card is tapped.
The account picker is used on the logon screen only (not when unlocking), in Active Directory mode, when the “Other user” tile is shown. Cards linked to one account, or to an account mapped to the computer, keep logging on with a single tap. Switch it off with AccountPicker = 0 (see reference); the user then selects the account tile or types the user name.
How do you stop the fallback account being used automatically?
Rule 3 — the only account without a “Log On To” list is used on all other PCs — is on by default. If that account must never be filled in automatically, for example because it is an administrator account, switch the fallback off:
- CodeB Admin Console: tab Logo & settings → untick “One card on several AD accounts: use the account without a Log On To list…” → Save settings.
- Registry (REG_SZ):
HKLM\SOFTWARE\WOW6432Node\CodeB\Config\UnmappedAccountFallback=0(missing or1= on). For many PCs use a Group Policy registry preference.
With the fallback off, a card tap fills in an account only on the PCs named in that account’s “Log On To” list; on every other PC the user selects the account in the picker.
Which settings and commands are involved?
| Where | Setting / command | Effect |
|---|---|---|
| Registry (REG_SZ) | HKLM\SOFTWARE\WOW6432Node\CodeB\Config\AccountPicker | Account picker. Missing or 1 = on (default), 0 = off. |
| Registry (REG_SZ) | HKLM\SOFTWARE\WOW6432Node\CodeB\Config\UnmappedAccountFallback | Fallback account. Missing or 1 = on (default), 0 = off. |
| CodeBAdminCLI.exe | /logonto <PC1,PC2 or *>, /showlogonto | Set or show “Log On To” for /user. Exit codes 1050–1054, 1002 — see Admin CLI. |
| CodeB Admin Console | Column Log On To, button Log On To… | On the Active Directory cards tab. |
Honest limits
- Works in Active Directory mode only. Local card files hold one user per card, so the per-computer choice does not apply to them.
- Needs a reachable domain controller at logon, like every AD card lookup.
- Every account keeps its own PIN and its own card validity (temporary cards).
- Not the same as shared accounts (several people, each with their own card, on one account) — that is the reverse case and needs no Log On To setup.
Troubleshooting
The tap shows the account list instead of logging on
No account of the card is mapped to this computer and there is no single unrestricted account (or the fallback is switched off). Pick the account and press Enter, or add this computer to the right account’s “Log On To” list.
“The card has no stored logon for the selected account”
The selected account has no card logon in Active Directory. Type that account’s password, or link the card to the account with /add2ad.
CodeBAdminCLI /logonto returns 1052 or 1054
1052: the account was not found. 1054: the PC running the command is not a domain member.
Frequently asked questions
Can one card log on to several Windows accounts?
Yes. Link the NFC card to each Active Directory account. CodeB uses the account whose Log On To list names the computer, otherwise the only account without such a list, otherwise it shows an account picker on the logon screen.
Can one card log on to different accounts on different PCs?
Yes. Set Log On To on the accounts, for example labuser1 only on LabPC1. CodeB then uses the account mapped to each computer automatically.
Do I need a different PIN for every account on my card?
No. Tap the card, pick the account from the list on the logon screen and press Enter, or map the accounts to computers with Log On To so the tap decides by itself.
Does it work with card token files instead of Active Directory?
No. The per-computer choice works in Active Directory mode only, because a local card token file holds one user per card.