PIV cards in Windows work shockingly well out of the box. I bought some Taglio-branded PIV cards to play with and have certificate-based logon to my webserver going in just a couple of hours. Logon to Windows itself took more work but wasn't too difficult.
That doesn't stop some people from installing other middleware like ActivClient (although it will let you change your PIN; no idea if this is in the Windows PIV driver since I mostly use my own (CACKey) and don't really use Windows)
