In CodeB Credential Provider V2 an NFC card can get a valid from and/or valid until date — for visitors, contractors or temporary staff. Outside that window the card is refused at logon and unlock, and Windows logs event 1102 (“temporary card refused”, with the reason) in the event log CodeB Credential Provider V2. It works for cards in Active Directory and for card token files, also on air-gapped PCs.
What is a temporary card?
A temporary card is a normal CodeB NFC card with a validity window. CodeB Credential Provider V2 checks the window at every logon and unlock. A card can have only a start, only an end, or both.
- Typical use: visitor and contractor cards, temporary staff, a card that must stop working on a contract end date.
- Where it works: NFC cards linked in Active Directory and card token files on the PC (also air-gapped).
- Refusal is audited: event ID
1102in CodeB Credential Provider V2. - Applies to: CodeB SmartLogin beta of 10 November 2026 and later, on every PC that checks the card.
How do you give a card an expiry date in the Admin Console?
- Open the CodeB Admin Console (
CodeBAdminConsole.exe, run as administrator). - For a new card: tab Active Directory cards → Add card… → enter account, card number and removal action, and fill in the optional validity window.
- For an existing card: select its row → Change validity…. Card token files on this PC are changed on the tab Cards on this PC the same way.
- The columns valid from, valid until and status show the result.
How do you create a temporary card on the command line?
Use /validfrom and /validuntil with CodeBAdminCLI.exe /add2fa, /add2ad or /add2fs:
CodeBAdminCLI.exe /add2fa /user jdoe /cardserial 04A1B2C3 /validuntil 2026-12-31
CodeBAdminCLI.exe /add2fs /user jdoe /password ******** /cardserial 04A1B2C3 /validfrom "2026-11-01 08:00" /validuntil "2026-11-30 18:00"Exit codes: 1030 = invalid date, 1031 = valid until is before valid from. Full list in the Admin CLI reference.
How are the dates read?
| Input | Meaning |
|---|---|
/validfrom 2026-11-01 | Valid from the start of 1 November 2026 (00:00), local time. |
/validuntil 2026-12-31 | Valid until the end of 31 December 2026, local time. |
/validfrom "2026-11-01 08:00" | Valid from exactly 08:00 local time. |
| No date given when enrolling | A permanent card. Re-enrolling an existing card without dates makes it permanent again. |
In Active Directory the window is part of the CodeB value in the user’s altSecurityIdentities attribute; the Admin Console shows the raw value.
What happens when a temporary card is used outside its window?
The card is refused at the logon and unlock screen, and Windows writes event 1102 (“temporary card refused”, with the reason) to the event log CodeB Credential Provider V2. No PIN or password is written. The event appears on the Logon log tab of the Admin Console and can be forwarded to a SIEM like the other CodeB audit events.
Honest limits
- The window applies to NFC cards linked in Active Directory and to card token files. It does not apply to Kerberos/KSP smart-card certificate containers or to 2FA links.
- Older CodeB versions ignore the window. Update all PCs before relying on it.
- Enrolling the same card again without dates (NFC dialog,
/add2faor/add2fswithout/validfrom//validuntil) makes it permanent again — by design. Re-enter the dates when re-enrolling a visitor card.
Troubleshooting
A card is refused and event 1102 is logged
The card is outside its validity window. Check valid from and valid until in the Admin Console and the PC’s clock and time zone; change the window with Change validity….
The card still works after its end date
The PC runs an older CodeB version that ignores the window, or the card was re-enrolled without dates. Update the PC and check the card’s dates.
Frequently asked questions
Can I give a visitor a card that expires?
Yes. Give the card a valid-until date in the CodeB Admin Console or with CodeBAdminCLI /validuntil. After that date the card is refused at logon and unlock and event 1102 is logged.
Can a card start working on a later date?
Yes. Set valid from, for example /validfrom "2026-11-01 08:00". Before that moment the card is refused.
Does a temporary card work on an offline or air-gapped PC?
Yes. The window is also checked for card token files stored on the PC, so no domain controller or network is needed.
Does the validity window apply to smart-card certificates?
No. It applies to NFC cards in Active Directory and to card token files, not to Kerberos/KSP certificate containers or 2FA links.