Is there a (preferably official) list of GPOs that affect the behaviour of makecert? The commandline options help does not discuss any; yet there seems to be a way to prevent .pvk creation somehow. I read somewhere about GPO affecting the use of self-signed certificates with EFS but nothing on this subject seems available. (I do not even know for sure it is the GPO settings doing this.)
Update: GPO is a long-shot hunch here - since there seems to be no known other way to prevent (with things that look like permissions problems) makecert from creating .pvk format files. Yet there are so many GPOs they are hard to keep track of here. Error is "Error: Can't create the key of the subject" with the PVK name repeated in (''). Then, "Failed" on the next line.
Of course if anyone knows of any other external-to-the-tool configuration items that affect makecert's behaviour that is welcome too; none of that is documented anywhere I can tell iether.