JSI Tip 9877. You receive a 'Failed to generate the certificate request' error when you attempt create a certificate request in IIS?

When you attempt to create a certificate request in IIS (Internet Information Services), you receive an error similar to:

Failed to generate the certificate request. Access is denied.

This behavior will occur is the administrator does NOT have Full Control permissions on the files and sub-folders at \Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys.

To resolve this problem:

1. Install the Extended Change Access Control List tool (Xcacls.vbs).

2. Open a CMD.EXE window.

3. Type the following command, replacing C:\Folder with the location of Xcacls.vbs:

cscript //nologo c:\folder\xcacls.vbs "%ALLUSERSPROFILE%\Application Data\Microsoft\Crypto\RSA\MachineKeys" /F /S /T /E /G "%ComputerName%\Administrator":F