We often come across issue where IIS admin service fails to start with multiple error codes and often error codes points to machine key corruption..
sharing one scenario below:
The IIS Admin Service terminated with “Key not valid for use in specified state “ which clearly means NTE_BAD_KEY_STATE. The machine key starting with c2319 for IIS admin service is corrupted
How it works?
--The IIS Admin Service attempts to load the IIS metabase, metabase.xml into memory upon startup.
--To do this, it has to be able to decrypt certain parts of the metabase, using a specific RSA machine key. if for some reason its unable to decrypt service cannot start
--The root cause is that the IISAdmin service cannot read the encrypted sections of the IIS Configuration file.
Corruption can happen due to multiple reasons
- By default IIS Machine Key is In C:\documents and settings\all users\application data\microsoft\crypto\RSA\MachineKeys folder. If there is any change like compression/permission change for this path we can see issue
- AV /encryption software scanning file
- application like doubletake.exe touching machine key files on reboot
- abrupt restart/shutdown when the MachineKeys files were accessed
- Metabase.xml is corrupt (due to reasons listed above)
- permission alternation of the machine key folder
We have seen usually patch /windows update has always been the victim of such issues.. We always suggest below practice so that “patch does not become victim of any issue”
- Before patching , reboot the server
- Once the server is up, check if all required application is working as expected
- Install patches
- Reboot the server
- check applications again
It is difficult for us to tell why the Machine Key file gets corrupted without any data. Audtiing can help us to provide more clues in case similar problem occurred again in future.
1 Enable auditing policy on the problematic IIS server:
- Click Start, click Run, type Gpedit.msc, and then click OK.
- Under Local Computer Policy, expand Computer Configuration, and then expand Windows Settings.
- Expand Security Settings, expand Local Policies, and then click Audit Policy.
- In the details pane, double-click Audit object access
- Click to select the Success check box, and then click to select the Failure check box.
- Click OK.
2 Enable auditing on the C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys folder.
- Right click the folder C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys and choose "Properties".
- Switch to "Security" tab, and click "Advanced" button.
- Switch to "Auditing" tab, and click "Add".
- Enter "Everyone" and then choose "OK".
- Check following operations, then choose "OK".
- Traverse Folder/Execute File
- Create Files/Write Data
- Create Folders/Append Data
- Write Attributes
- Write Extended Attributes
- Delete Subfolders or files
- Delete
- Change Permissions
- Take Ownership
- Choose "OK" to confirm the change.
