sn.exe fails with Access Denied error message

Question

I get an Access is Denied error message when I use the strong name tool to create a new key to sign a .NET assembly. This works just fine on a Windows XP machine but it does not work on my Vista machine.

PS C:\users\brian\Dev\Projects\BELib\BELib> sn -k keypair.snk

Microsoft (R) .NET Framework Strong Name Utility  Version 3.5.21022.8
Copyright (c) Microsoft Corporation.  All rights reserved.

Failed to generate a strong name key pair -- Access is denied.

What causes this problem and how can I fix it?

---

Are you running your PowerShell or Command Prompt as an Administrator? I found this to be the first place to look until you get used to User Access Control or by turning User Access Control off.

Yes I have tried running PS and the regular command prompt as administrator. The same error message comes up.

Numismatist

Answer 1

Yes I have tried running PS and the regular command prompt as administrator. The same error message comes up.

Another possible solution could be that you need to give your user account access to the key container located at C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys

Guthrun

Damn, wish I could give more than +1. I love you SO! – Grunberg

On Windows 7 the path is C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys. You may have to enable showing of hidden and system files to see the All Users folder. – Embargo

On Win 10 its also C:\Users\All Users\Microsoft\Crypto\RSA. Facepalm that this must be done on every new install, but is not documented by Microsoft. – Myopic

Answer 2

Are you running your PowerShell or Command Prompt as an Administrator? I found this to be the first place to look until you get used to User Access Control or by turning User Access Control off.

Guthrun

It's User Account Control! – Asphyxiant

Answer 3

Why not fire up sysinternals Process Monitor too see what you can see, it's the first thing I always do when I get any kind of access denied message?

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Geranium

Answer 4

Just to update this a bit: I ran into the same problem on Vista. My local user on the PC had no problem but then we switched to a domain and my domain user (albeit having local admin rights) got "Access Denied". I granted my domain user access rights to C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys and that fixed it.

Megalith

On Windows 7 it's C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys – Menopause

%ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys – Byssinosis

Answer 5

Some people rebuild their machines to resolve this problem, but it can be solved by giving user access to the key container C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys Each container created using sn.exe -i is located in the MachineKeys directory (unless you specify elsewhere). The default key container that is used by sn.exe is also in that location.

In case you reset your key container to a new one, and forget where it is.. you can reset the key container for the strong name utility using sn.exe -c. So, if the account access fix doesn't work, you may be using an alternate key store so a reset may be in order.

Senior

Answer 6

Updating this for Win 10+:

The new path is: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

Since System is the owner of the folder, you will need to change it to a user or group that has Administrator access. Once you've done this, you can proceed to alter the permission on Everyone to Read/Write.

Officialism