30

I've recently upgraded to WIndows 7. When I try to sign the assembly in VS2010 I get an "Access is denied" error. I am logged as admin so I'm puzzled. What service account does VS uses that I should elevate its privilages?

Thanks,

Risho

1
  • Question appears to be still relevant for Windows 10 Pro + Visual Studio 2019. Use sn tool to fix this as proposed by Tom Minka in comment to best answer. Jun 12, 2021 at 20:48

4 Answers 4

51

I don't know if it's Window 7 or the company policy, but I had to take ownership of the C:\Users\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys folder and give myself full control. This corrected the issue.

6
  • 2
    Yep, this definitely works. Obnoxious problem. All you need is 'This folder only' set to 'Full Control'.
    – user7116
    Sep 27, 2012 at 17:06
  • 11
    Using Windows 10 the folder differed slightly: I had to add the rights to C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys (no Application Data), but otherwise it worked as described.
    – SJP
    May 10, 2016 at 11:03
  • 10
    @SJP FYI, C:\Users\All Users is an alias for C:\ProgramData which is visible without showing hidden system files.
    – mejdev
    May 16, 2016 at 15:20
  • 4
    For me it was 'C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys' but the same principle worked. Aug 10, 2018 at 19:48
  • Didn't work for me, I'm running VS as admin and surely admin has full control but still getting the errors Jan 8, 2020 at 8:09
27

Solution:

Run the following command from Administrator command prompt:

For 64-bit systems:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\StrongName /v MachineKeyset /t REG_DWORD /d 0

For 32-bit systems:

reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\StrongName /v MachineKeyset /t REG_DWORD /d 0

The change affects immediately.

Why this happens:

MS Assembly Linker ALINK (AL.EXE) used by Visual Studio to sign assemblies creates a temporary crypto key during its work. Actually it uses some internal CLR functions for this, and the problem is that CRYPT_MACHINE_KEYSET flag is used by default. This requires elevation, and that's why running VS "as Administrator" works.

But, fortunately, I found that CLR has a global flag for StrongName signing, and it's stored in the system registry under

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\StrongName

and is controlled by DWORD value

MachineKeyset.

0 - use current user key set

1 - use machine key set (this is default)

Visual Studio is a 32-bit app and uses 32-bit version of AL.EXE for build. So on 64-bit systems it's subject to registry redirection, and the flag is located under the key

HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\StrongName

It works on my VS2019, Win10, and .Net framework 4.8, but I didn't test it on previous versions though.

2
  • 5
    You can also perform these functions using the sn tool: sn -m displays the current value of MachineKeyset, sn -m n sets the registry values above
    – Tom Minka
    Jun 17, 2020 at 18:42
  • 1
    On Win 64-bit it was not working until I changed both this keys. Oct 23, 2020 at 16:35
2

For windows 10 and VS 2015, I have to run VS as administrator.

1
  • 1
    Didn't work for me, I'm running VS as admin and surely admin has full control but still getting the errors. Jan 8, 2020 at 8:09
2

On Win10 I gave the user who im starting Visual Studio with, rights to read, write, run, change and display for the folder:

C:\ProgramData\Microsoft\Crypto

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.