Default permissions for the MachineKeys folders (278381)

MORE INFORMATION

The MachineKeys folder is located under the All Users Profile\Application Data\Microsoft\Crypto\RSA folder. If the administrator did not set the folder to the minimum level, a user may receive the "Failed to Generate Certificate Request" and "An Internal error occurred" error messages when the user generates a server certificate by using Microsoft Internet Information Server (IIS). The following settings are the default permissions for the MachineKeys folder:

Administrator	(Full Control)		This folder only
Everyone	(Special)		This folder, subfolders, and files
SYSTEM		(Full Control)		This folder, subfolders, and files

To view the special permissions for the Everyone group, right-click the MachineKeys folder, click Advanced on the Security tab, and then click View/Edit. The permissions consist of the following permissions:

• List Folder/Read Data
• Read Attributes
• Read Extended Attributes
• Create Files/Write Data
• Create Folders/Append Data
• Write Attributes
• Write Extended Attributes
• Read Permissions

Select the Reset Permissions on all Child objects and enable propagation of inheritable permissions check box. The administrator does not have full control on child objects to protect a user's private part of the key pair. However, the administrator can still delete certificates for a user.

For more information, click the following article numbers to view the articles in the Microsoft Knowledge Base: