title: Smartcard Authentication stopped working on IIS 7.5 - everybody gets 401
body: <p>Everything was fine when we left on Friday. After the weekend, all users get 401 trying to authenticate to the web site. Our Web Server is IIS 7.5 in Windows Server 2008 R2. The site's SSL Settings are Require SSL and client certificate required. The Web Server level Authentication options are set to disabled except for Active Directory Client Certificate Authentication which is enabled. At the site level, Authentication options are all set to "Disabled." the Authentication Rules have a single entry which is to allow a specified user group, webUser. </p>
  
  <p>Using Configuration Editor, I set up manyToOneCertificateMappings for each user using their CN and issuer from their smartcard, the DoD CAC. They map to a local user who is a member of the webUser group.</p>
  
  <p>When a user goes to the site, they get "401 - Unauthorized: Access is denied due to invalid credentials."
  "You do not have permission to view this directory or page using the credentials that you supplied."</p>
  
  <p>In the event log, I found errors but they stretch back long before we had trouble. This one confuses me because the NetLogon service is running. 
  Failure Information:
      Failure Reason:     The NetLogon component is not active.
      Status:         0xc0000192
      Sub Status:     0x80090325</p>
  
  <p>I tried raising the privilege of the local user account to admin but no change. I confirmed that the certificates get checked using OCSD and tested with good and revoked certs. All certs are still valid. </p>
  
  <p>Although everybody got workstations updates pushed over the weekend, nobody changed the server. I imagine that the root cause is something expired.</p>
  
  <p>How can I tell if the certificate matching to the local user account is the problem or if the local user account is the problem? </p>