Cryptographic token authentication on standalone clients

Hi,

I have some questions about how SafeGuard (5.60.3) works concerning cryptographic token authentication on standalone clients. The documentation mixes server and standalone modes, so I am not totally sure, what has to be done to get it working.

1) On the first start of the Management Console the company certificate is generated or imported. Is this always the base for created user certificates on standalone clients?

2) Is it only possible to authenticate certificates and tokens created with the current Management Console? Or is it always necessary to use a CCO to change the company certificate?

3) What impact have imported root and CA certificates on standalone clients in that context?

4) Is it possible to authenticate tokens, which have been created by an external PKI without access to any private keys, e.g. by importing the public certificates?

5) Is it necessary to import certificates in Windows?

6) How are Windows users mapped to tokens on standalone clients if user/password and token authentication is allowed?

Thank you in advance.