How To: View Existing Permissions on the NetFrameworkConfiguration RSA Machine Key

Version Affected: All

 

Overview

This article explains how to view which permissions are already assigned to the NetFrameworkConfiguration RSA Machine Key, using a PowerShell script -- useful when confirming whether an account or process has the access it needs to that key.

View Permissions on the NetFrameworkConfiguration RSA Machine Key

1. Open PowerShell on the IdP appliance (run as Administrator).
2. Copy the following script in as a single line and press Enter:

$NFCKHex = (certutil -key NetFrameworkConfigurationKey)[2].Trim(); $icacls=(icacls.exe $env:ProgramData\Microsoft\Crypto\RSA\MachineKeys\$NFCKHex)-Replace('^\S*',''); $ii = $icacls.length-3; foreach ($i in $icacls[0..$ii]){$i.Trim() | Write-Host}

The script prints the permissions currently assigned to the key, one entry per line, using the following abbreviations:

• R -- Read Permission
• W -- Write Permission
• RX -- Read and Execute Permission
• M -- Modify Permission
• F -- Full Permission

SecureAuth Knowledge Base Articles provide information based on specific use cases and may not apply to all appliances or configurations. Be advised that these instructions could cause harm to the environment if not followed correctly or if they do not apply to the current use case.

Customers are responsible for their own due diligence prior to utilizing this information and agree that SecureAuth is not liable for any issues caused by misconfiguration directly or indirectly related to SecureAuth products.