I use a standalone laptop at a large client who smart cards. I usually just plug-in my laptop and enter the credentials they provided to get access to their e-mail and internal websites.

There is a new policy forcing the use of smart cards for everyone including me. How can I use my smart card they issued me from a my laptop. A few facts:

  • The Windows 7 laptop is not part of a domain.
  • I have the smart card reader and smart card drivers working properly.
  • When a password dialog comes up, I have the smart card option and I can enter my pin, however I am never successfully authenticated.
  • I have seen two different messages in the system event log:

    1. The kerberos SSPI package generated an output token of size 22606 bytes, which was too large to fit in the token buffer of size 12000 bytes, provided by process id 3448. The output SSPI token being too large is probably the result of the user [USER REPLACED] being a member of a large number of groups.

    2. The Distinguished Name in the subject field of your smartcard logon certificate does not contain enough information to locate the appropriate domain on an unjoined machine. Please contact your system administrator.

I believe the second event is the most significant since I'm not part of the domain.

Thanks for any help.



Sounds like it MAY be a certificate problem. I presume you (not your machine) have a domain user account and have certificates issued.

  • Yes, the certificate on the smart card is associated with my domain user account. The subject on the certificate is something like "CN = USERID". Unfortunately, there is no domain name. I was hoping for a registry key or something that would set a default domain for kerberos. – Zach Jul 8 '11 at 13:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.