Certificate + Password/PIN should be okay. You can maybe create a policy for the target system to enable a screensaver to block the screen after short period that will force user to enter his/hers password..? I know in theory all seems easy :-) :-) Good luck! :-) -- CeDeROM, SQ7MHZ, http://www.tomek.cedro.info