Cannot log onto government PC: 'Credentials could not be verified'

1. Have another user log in with their CAC and run the DoD InstallRoot tool to refresh certificates. 2. Confirm with the help desk that your AD account still exists and is not locked. 3. Verify network cable is connected; if machine has been off-network 45-60 days it may have been removed. 4. Try a cached login: unplug network, log in, then plug network back in. 5. Dual CAC holders must use the same CAC last used on this domain. 6. In ActivClient, open My Certificates > double-click any cert > Advanced tab > scroll to Subject Alternative Name. The UPN must match your AD login name. 7. If Credant DAR is installed, the data-at-rest layer may need decryption. 8. Verify the Smart Card service is running (see cacdrivers.htm). 9. Make sure the EDI-PI (10-digit) cert is being presented, not the legacy FASC-N (16-digit) cert. 10. If you got a new CAC after June 11, 2016 and your account is one of the legacy types, ask for a fresh standard account - DISA had Root CA3/CA4 issues with the old type.