Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I use a standalone laptop at a large client who smart cards. I usually just plug-in my laptop and enter the credentials they provided to get access to their e-mail and internal websites.

There is a new policy forcing the use of smart cards for everyone including me. How can I use my smart card they issued me from a my laptop. A few facts:

  • The Windows 7 laptop is not part of a domain.
  • I have the smart card reader and smart card drivers working properly.
  • When a password dialog comes up, I have the smart card option and I can enter my pin, however I am never successfully authenticated.
  • I have seen two different messages in the system event log:

    1. The kerberos SSPI package generated an output token of size 22606 bytes, which was too large to fit in the token buffer of size 12000 bytes, provided by process id 3448. The output SSPI token being too large is probably the result of the user [USER REPLACED] being a member of a large number of groups.

    2. The Distinguished Name in the subject field of your smartcard logon certificate does not contain enough information to locate the appropriate domain on an unjoined machine. Please contact your system administrator.

I believe the second event is the most significant since I'm not part of the domain.

Thanks for any help.


share|improve this question

Sounds like it MAY be a certificate problem. I presume you (not your machine) have a domain user account and have certificates issued.

share|improve this answer
Yes, the certificate on the smart card is associated with my domain user account. The subject on the certificate is something like "CN = USERID". Unfortunately, there is no domain name. I was hoping for a registry key or something that would set a default domain for kerberos. – Zach Jul 8 '11 at 13:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .