Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am setting up a second site on our Windows 2008 R2 server. We use a RSA Key Container to encrypt our connection strings. I created a new Application Pool with all the same settings as our Default Application Pool that is supporting our current site, including using the same user account for the identity. When I try to access the new site I get the following error: The RSA key container could not be opened

If I change the new website to use our Default Application Pool it works. So I try and give the user account in the new Application Pool access to the RSA Key Container using the following command in an Administrator Command Prompt:

aspnet_regiis -pa "KeyContainerName" "dmz\UserName"

I get the following error: The RSA key container was not found.

I run the following command to install the key container:

aspnet_regiis -pi "KeyContainerName" "c:\keys.xml"

I get the following error: Object already exists

I try and run the following command to delete the key container:

aspnet_regiis -pz "KeyContainerName"

I get this error: The RSA key container was not found. Failed!

So I am completely baffled, one command tells me it already exists which makes sense because I know our one website is using it, but when I tried to delete it tells me it doesn't exist. It works for one app pool but not for a new app pool using the exact same identity? I did this exact same setup on 12 other servers and they all worked fine.

share|improve this question
up vote 1 down vote accepted

I have had something similar.

If the account you are using does not have permission to the key container then when you try to grant permission to it (aspnet_regiis -pa "KeyContainerName" "dmz\UserName") you get the Key Container not found error. However the key does exist; hence, the error when you try to re-create it.

This would mean that the key was created by a different account.

If you can log on as that account you can then do

aspnet_regiis -pa "KeyContainerName" "dmz\YourUserName" -full

to grant your own account control of the key. I would suggest setting up a KeyAdministrators NT group and granting access to that and getting yourself in the group.

share|improve this answer

"I did the same thing on 12 other servers and it worked fine"


Reimage the server or start again. Something is clearly different about this one, even at this early stage.

If you're doing exactly the same thing (incidentaly, why isn't it scripted?) on every server, and they've all behaved identically and were all configured identically but this one's somehow different, things will only get worse from here.

share|improve this answer
Is there any way to actually see the RSA certificates to figure out why it is there but inaccessable? – patridge Aug 3 '11 at 20:45
Start with ProcMon or ProcExp from but again, if you're expecting to start from a common platform, and you're not, this could be the tip of the iceberg. Or it could be the one broken thing - point is, you've got an inconsistent build, and that needs to be fixed before other assumptions can be made safely. – TristanK Aug 6 '11 at 1:51

Check or try using the full path to aspnet_regiis.exe. As you may be aware, this can be either a 32-bit or 64-bit version. E.g.:

%SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis -pa "KeyContainerName" "domain\user"  
%SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis -pa "KeyContainerName" "domain\user"  

%SYSTEMROOT%\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis -pa "KeyContainerName" "domain\user"  
%SYSTEMROOT%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis -pa "KeyContainerName" "domain\user"  

%SYSTEMROOT%\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis -pi "KeyContainerName" "c:\keys.xml"  
%SYSTEMROOT%\Microsoft.NET\Framework\v4.0.30319\aspnet_regiis -pi "KeyContainerName" "c:\keys.xml"  

%SYSTEMROOT%\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis -pi "KeyContainerName" "c:\keys.xml"  
%SYSTEMROOT%\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis -pi "KeyContainerName" "c:\keys.xml"  
share|improve this answer
When I actually ran the regiis I was running from the 32 bit Framework for 2.0, which is what I did on all of the other servers and it worked for them. I tried it from the other framework paths and still no go. – Blegger Aug 3 '11 at 15:46

We had this same issue on a cloned server, but could not get Paul's solution to work. Instead what we did was search our computer for the file machineKeys, and deleted the one from the ...\Crypto\RSA\ folder.

After doing this we were able to recreate the RSA Key Container. This then recreated the machineKeys file we deleted.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.