VPN Server 2k3 with Cert Services, singel NIC, client gets error 6

I have Stand-alone Certificate Authority installed on 2k3 RRAS behind a NAT
firewall. Certificates are issued to clients, Port 1723 for PPTP is open on
firewall and points to VPN Server running the Cert Authority but the clients
receive error 691, username/password cannot be found. When using a
stand-alone Certificate Authority, do you need to tie the client certificate
to the client Active Directory user account manually or is it automatically
done by the (E-Mail Removed)l identification field?
Any info would be appreciated.