Device removal detection is implemented through plug-in DLLs that are registered with the Secure Workstation Service. When a user logs in to the workstation, the Secure Workstation Service starts the device removal plug-ins for the devices specified in the policy. The lock action will be taken when one of the plug-ins reports that its authentication device is no longer present.
Currently, device removal plug-ins are available for the pcProx and Universal SmartCard methods only.