We often come across issue where IIS admin service fails to start with multiple error codes and often error codes points to machine key corruption..
sharing one scenario below:
The IIS Admin Service terminated with “Key not valid for use in specified state “ which clearly means NTE_BAD_KEY_STATE. The machine key starting with c2319 for IIS admin service is corrupted
How it works?
--The IIS Admin Service attempts to load the IIS metabase, metabase.xml into memory upon startup.
--To do this, it has to be able to decrypt certain parts of the metabase, using a specific RSA machine key. if for some reason its unable to decrypt service cannot start
--The root cause is that the IISAdmin service cannot read the encrypted sections of the IIS Configuration file.
Corruption can happen due to multiple reasons
By default IIS Machine Key is In C:\documents and settings\all users\application data\microsoft\crypto\RSA\MachineKeys folder. If there is any change like compression/permission change for this path we can see issue
AV /encryption software scanning file
application like doubletake.exe touching machine key files on reboot
abrupt restart/shutdown when the MachineKeys files were accessed
Metabase.xml is corrupt (due to reasons listed above)
permission alternation of the machine key folder
We have seen usually patch /windows update has always been the victim of such issues.. We always suggest below practice so that “patch does not become victim of any issue”
Before patching , reboot the server
Once the server is up, check if all required application is working as expected
Reboot the server
check applications again
It is difficult for us to tell why the Machine Key file gets corrupted without any data. Audtiing can help us to provide more clues in case similar problem occurred again in future.
1 Enable auditing policy on the problematic IIS server:
Click Start, click Run, type Gpedit.msc, and then click OK.
Under Local Computer Policy, expand Computer Configuration, and then expand Windows Settings.
Expand Security Settings, expand Local Policies, and then click Audit Policy.
In the details pane, double-click Audit object access
Click to select the Success check box, and then click to select the Failure check box.
2 Enable auditing on the C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys folder.
Right click the folder C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys and choose "Properties".
Switch to "Security" tab, and click "Advanced" button.