“Token” based authentication in Windows Environment

Anyone have any experience with this type of system? I would love to be able to set up usb “tokens” for each employee, so as to remove the need for complex passwords. I could keep the recovery key (copies of the tokes) in an encrypted vault.
I guess what I am looking for is a system of generating public/private keys for use in authenticating users in a win2k3 environment. Preferably by putting them on a usb key which is checked for on boot. For all I know, this may already be part of IAS…
Anyone have any experience they would like to share or pointers on more reading?
My current “budget” does not allow for a commercial product, so I may be SOL.