Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I only have a installed Windows Server 2008 with Active Directory Domain, Web Server (IIS) and a bunch of USB Tokens on the table.

Which are the steps to install the necessary components and configure Windows Server 2008, IIS, AD to use USB Tokens for authentication?

share|improve this question
Depends a LOT on the tokens. Did you ever even consider doing something as crazy as reading the documentation provided with the tokens, or adding the manufacturer / type to the question so someone here can do your first steps? – TomTom Mar 8 '11 at 13:14
up vote 1 down vote accepted

It depends on the clients acutally. The newer the better. I think USB token native support was added in Vista and newer. Check token provider for native OS support.

Documentation from the token provider will help, and it helps if you have some management software from the provider to see what's on the token, wipe it, etc.

The general process is once you have your CA properly setup in AD you can issue user-based certificates to the token the same way you would for a smartcard. Since smartcard's are much more popular you can follow any walkthroughs on google for smartcard setup in active directory. Once you've issued a user certificate to the token, you should be able to plug it into a client computer and Vista/Win7 should allow you to sign in with the token and a PIN that was set during certificate issue (if required).

It requires no changes on the client that I know of other then insuring the OS has native support (built-in drivers) for the token or the drivers were installed before you try to use the token.

share|improve this answer
thank you for your answer, I can safely assume we will use Windows 7 so no problems from this point of view. The USB tokens do not already have a certificate on them? Any ideea how this certificate is associated with a user? Thanks for the smartcard tip, I will check. – Aleris Mar 8 '11 at 14:57
USB tokens should be empty. What you're doing here is using your private CA you added to AD to issue a certificate to an AD user account that is stored on that token and associated with their AD account. AD user profile will have their public cert stored in that profile which tells AD the user is allowed to use that cert/key combo to authenicate. The token stores the private key, usually behind a PIN. The private key can't be pulled off the token usually, but you can wipe it and add another users cert/key combo to it. Some tokens support multiple keys on the token if you need to do that. – Bret Fisher Mar 8 '11 at 15:08
good walkthrough that looks correct: – Bret Fisher Mar 8 '11 at 15:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.