System Tray Edition
All helpers in one unified system-tray application. Required if you need actions on card-remove (auto-lock or sign-out). Easiest rollout for daily use on shared workstations.
03 · Credential Provider V2 · Flagship of the CodeB line
Replace the Windows
password tile.
NFC cards. TOTP. PKI smartcards. USB tokens. Second factor or full passwordless — whichever your security model demands. 100 % managed .NET, FIPS 140-2 enforceable by Group Policy, deployed where the Microsoft password tile cannot stay.
Windows 8 · 8.1 · 10 · 11 · Server 2012 R2 through 2025 · x86 + x64 · Air-gapped supported · No cloud connection required
All editions · signed installers · free
Pick the package that matches your deployment.
The same Credential Provider V2 sits underneath every edition — the difference is how the supporting tools are packaged. Daily-use workstation? Take the System Tray Edition. Air-gapped or scripted? Tools Edition. Rolling out hundreds of NFC cards? Add the Admin CLI.
Tools Edition
Each helper is a standalone executable. Admins install exactly the tools they need and nothing they don't — useful when scripted, scheduled or composed into a wider workflow. Card-remove actions are not included; choose the System Tray Edition if you need them.
CodeB Admin CLI
Standalone command-line utility for system administrators. Same enrolment actions the GUI helpers do — link an NFC card to an AD user, store encrypted credentials, audit assignments, revoke a card — but unattended, from any batch script, PowerShell pipeline or SCCM task. 500 cards by hand is a week; CSV in a loop is an afternoon.
CodeB Desktop Switcher
Single executable, under 1 MB. Swaps your visible desktop — files, icon positions, per-monitor wallpapers — with one click. Useful right before screen sharing on Zoom / Teams / Google Meet, and for kiosks where you want a known-clean layout on demand. No dependency on the Credential Provider.
Production tip: the System Tray icon can be hidden from end users by setting the registry value HKLM\\SOFTWARE\\WOW6432Node\\CodeB\\Config\\HideSystray. The helper keeps running — including card-remove actions — but ordinary users can't see or misconfigure it.
Which edition do I need?
Edition feature matrix.
| Capability | System Tray | Tools | Admin CLI |
|---|---|---|---|
| Replaces the Microsoft password tile | Yes | Yes | — |
| NFC / TOTP / smartcard / USB token logon | Yes | Yes | — |
| Card-remove auto-lock or sign-out | Yes | No | — |
| Helpers as standalone .exe (scriptable) | Bundled | Yes | Yes |
| Unattended CSV-driven enrolment | No | No | Yes |
| System Tray icon (hideable via GPO) | Yes | No | — |
| Local accounts, AD & Entra ID | All three | All three | Local + AD |
| Windows 8 / 8.1 support | Yes | Yes | Yes |
| Windows Server 2025 support | Yes | Yes | Yes |
| FIPS 140-2 enforceable by GPO | Yes | Yes | Yes |
Not sure? Ask. We'll match the edition to your environment in a five-minute call. Request a consultation →
Where it's deployed
Built for regulated industries.
Healthcare · shared clinical workstations
NFC card tap signs the clinician in; pulling the card auto-locks the workstation before the next clinician arrives. Compatible with the same NFC reader hardware your access-control system already uses.
Manufacturing · air-gapped shop floor
Zero cloud dependency. Zero outbound network calls. Runs identically on a workstation that has never seen the internet. Operator badge logon for line workstations, smartcard logon for QA terminals.
Regulated offices · legal, finance, public sector
Replace password rotation with smartcard-issued credentials. FIPS 140-2 enforceable by Group Policy means your CISO can prove the configuration matches the audit binder.
Embedded / kiosk / industrial PCs
Windows 8 and Server 2012 R2 still work. Tools Edition gives you the minimum surface area for a locked-down deployment image. Admin CLI scripts the enrolment so cloning a thousand kiosks is one batch job.
Technical specs
Everything you'll ask before procurement.
Platform
- Windows 8, 8.1, 10, 11 (x86 + x64)
- Windows Server 2012 R2 through 2025
- Local accounts, Active Directory, Entra ID
- Air-gapped supported — no cloud connection required
- No telemetry, no analytics, no call-home
Authenticators
- NFC cards (Mifare DESFire, Mifare Classic, NTAG)
- TOTP (RFC 6238 — any authenticator app)
- PKI smartcards (PIV, PKCS#11, CSP)
- USB tokens (CCID, vendor SDKs)
- Combinable as multi-factor or pure passwordless
Standards & compliance
- Microsoft Credential Provider Filter API (documented)
- 100 % managed .NET; no kernel drivers
- FIPS 140-2 enforceable by Group Policy
- NIS2-aligned (operator-driven hardening)
- Signed installers; binaries verifiable on disk
Operations
- System Tray icon hideable via registry GPO
- Admin CLI for SCCM / PowerShell / batch rollouts
- CSV-driven card-to-user binding
- Audit trail of assignment + revocation
- No additional infrastructure required
Three ways to engage
Ready to evaluate?
We ship full evaluation keys inside 24 hours and we'll script your first rollout for you if it helps. Email lands with humans, not a queue. Reply within one business day.
01
Request an evaluation key
Fill the contact form with your environment details. Eval key + setup guidance ships within 24 hours.
contact.html →
02
Email us directly
Forward an RFP, attach a deployment diagram, ask for a quote — we'll come back with the right person and the right answer.
info@aloaha.com →
03
Call us in the browser
WebRTC, one click. No app, no number. Rings the office during CET business hours. Powered by the same SIP bridge we sell.
Click to call →