Mapping Client Certificates with Directory Service Mapping

Applies To: Windows Server 2003, Windows Server 2003 R2, Windows Server 2003 with SP1


If you use directory service mapping, you cannot use one-to-one or many-to-one mapping for the entire World Wide Web Publishing Service (WWW service).

Directory service (DS) certificate mapping uses native Windows Active Directory features to authenticate users with client certificates. For information about mapping a certificate to an Active Directory user account, see "Map a certificate to a user account" in Help and Support Center for Windows Server 2003.


You must be a member of the Administrators group on the local computer to perform the following procedure or procedures. As a security best practice, log on to your computer by using an account that is not in the Administrators group, and then use the runas command to run IIS Manager as an administrator. At a command prompt, type runas /user:Administrative_AccountName "mmc %systemroot%\system32\inetsrv\iis.msc".


To enable Directory Service mapping

  1. In IIS Manager, right-click the Web Sites node, and then click Properties.

  2. On the Directory Security tab, select the Enable the Windows directory service mapper check box, and then click OK.