Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Question
Saturday, June 24, 2017 3:06 PM
BLUF: When trying to start the IIS ADMIN service, I receive the following error:
"Windows could not start the IIS Admin Service on Local Computer. For more information, review the System Event Log. If this is a non-Microsoft service, contact the service vendor, and refer to service-specific error code -2146893809."
And the following log in Event Viewer:
Source: Service Control Manager
EventID: 1024
"The IIS Admin Service service terminated with the following service-specific error:
Object already exists."
BACKGROUND:
After upgrading to Windows 10 CU Enterprise 1703, I was experiencing the known RDC issue. Ref here:
In an attempt to resolve the issue, it was suggested to rename and recreate the following DIR:
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
I did that and it resolved the RDC problem. However, I cannot start the IIS Admin service now. IIS Manager and W3SVC both start and the webserver seems to be working okay, but I know there is a major underlying issue here.
So, how do I recreate the key that IIS Admin uses?
P.S. I DID try to restore my backup copy of the \RSA\machinekyes DIR, but I tried to migrate them and polluted both the backup DIR and the working copy. So, restoring is NOT an option for me.
THANKS!
All replies (7)
Tuesday, June 27, 2017 9:49 AM âś…Answered
Hi seanvree,
You could try to remove it from machinekeys DIR. Also backup it up to avoid an unhandled exception.
Best Regards,
Yuk Ding
Monday, June 26, 2017 9:37 AM
Hi seanvree,
Do you have a machinekey which is named C23* in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys? IIS also rely on this machinekey. Try to reinstall IIS with IIS 6 Management Compatibility. It should regenerate the machinekey. Then open registry and check if the value in works HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MachineGuid is the same as the machine key in machinekeys folder.
The following link provide the steps to fix this issue
https://blogs.msdn.microsoft.com/saurabh_singh/2007/08/01/iis-admin-service-fail-to-start/
https://blogs.msdn.microsoft.com/vivekkum/2009/02/14/machinekey-in-iis/
Best Regards,
Yuk Ding
Monday, June 26, 2017 10:17 AM
Yuk,
thanks for the response.
1)
Yes, I do have a key named C23. However, I think the permissions MAY be wrong:
Owner: SYSTEM
Permission Entries:
Principle: Everyone // Acess: Special // Applies to: This folder only
Principle: Administrators // Access: Full Control // Applies to This folder only
Principle: SYSTEM // Access: Full Control // Applies to: This folder, subfolders and files
Is this right? If NOT, how do I reset the security for the MachineKeys folder? I tried to make changes to it as the local administrator, but I got mostly "access denied" errors.
Or do I delete that Key and reinstall IIS?
2) IF i reinstall IIS, do I lose all my website data? For example, my default website in inetpub\wwwroot ?
3) I did check the value in the registry at Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography and that value DOES match the suffix of the C23 key. So, what does that mean? I would seem that I DO have the key in the proper DIR and it matches the registry..so should I still reinstall IIS?
Thanks!
Tuesday, June 27, 2017 9:16 AM
Hi seanvree,
The permission seems to be correct without any issue.
Reinstall IIS could lose the websites. So it is necessary to backup the configurations:https://blogs.iis.net/bills/how-to-backup-restore-iis7-configuration. It will not delete the data but lose the website in IIS.
3) I did check the value in the registry at Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography and that value DOES match the suffix of the C23 key. So, what does that mean? I would seem that I DO have the key in the proper DIR and it matches the registry..so should I still reinstall IIS?
It just show that the IIS is loading the correct machinekey. Considering the material about this key is all related to IIS6 instead of IIS7. It seems lose the solution to handle such kind of error in IIS 7. Try to reinstall IIS, maybe able to fix this issue.
Best Regards,
Yuk Ding
Tuesday, June 27, 2017 9:18 AM
Okay, got it.
Should I remove the C23 key from the MachineKeys DIR and/or the registry before reinstalling IIS?
Tuesday, June 27, 2017 7:06 PM
Yuk,
You're the man, thanks! Got both RDC and IIS back!
Cheers.
Wednesday, June 28, 2017 1:31 AM
Hi seanvree,
I'm glad that your issue could be resolved.
Best Regards,
Yuk Ding