Listing users with access to NetFrameworkConfigurationKey ACL

Question

I have added some users to the Access Control List(ACL) for the RSA Key Container using “aspnet_regiis -pa \"NetFrameworkConfigura

Answer 1

1. Find the file that contains the key. If this is a machine key, they are located here: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
   • You can open these files as text; look for NetFrameworkConfigurationKey on the first line.
   • On machines I have tested with, the correct file seems to start with d6d9
2. Just right-click on the file, Properties, and view the Security tab

Answer 2

Command prompt technique:

1. Find the hex value (69 characters long) of your named key.

certutil -key NetFrameworkConfigurationKey

2. Use icacls to list users and permissions.

icacls %ProgramData%\Microsoft\Crypto\RSA\MachineKeys\<your hex value>

Where permissions are represented by:
N = no access
F = full access
M = modify access
RX = read and execute access
R = read-only access
W = write-only access
D = delete access