Machine Keys - What exactley are they?

[Rawns]

Battling with various SOLUS3 issues in some schools, sometimes a lot of it comes down to the permissions settings with the 'machine keys', specifically the files found in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys. While I can fix most of these permissions issue, I'm not 100% sure on what this files actually are or what they are used for. Can anyone shed some light on these for me?

[sonofsanta]

Machine keys will mean registry keys under HKEY_LOCAL_MACHINE (aka HKLM). Registry keys can have permissions set on them in the same way that files/folders can, just right-click in regedit.

 

I've never suffered SIMS so I can't help you specifically, but that might be enough to point you in the right direction...

 

EDIT: of course, with everything I hear about Capita, it may well be that they're referring to something else as a Machine Key just to confuse the issue.

[sparkeh]

Not reg keys.

This is to do with certificates. I guess S3 uses certificates on the clients and the permissions thing means it can't create the certs... or something.

 

edit:

From http://support.microsoft.com/kb/278381

The MachineKeys folder stores certificate pair keys for both the computer and users. Both Certificate services and Internet Explorer use this folder.

Edited October 7, 2013 by sparkeh

[Ghostgame]

Key starting with 1db350cf1106 is to do with the S3 agents. Have found sometimes if not deleted or user permissions are not given that you can't reinstall the S3 agent sometimes.

 

Key starting with 1728bae20fb3 seems to do with the S3 UI modules. Seems if the a person or group does not have the right permissions to that key they can't access the S3 settings for the SIMS/FMS/Discover channel.

 

I don't know if they effect anything else but this is what I have worked out.

[theriver]

Not reg keys.

This is to do with certificates. I guess S3 uses certificates on the clients and the permissions thing means it can't create the certs... or something.

 

edit:

 

Yes. If you import a certificate into a store and then attempt to access it from another account (e.g. a service account/app pool), then you may be needing to juggle permissions.