Cryptographic Operation: Operation: Decrypt. Return Code: 0x80090010

Question

Hi,
Attempting to setup NPS Server 2012 to use 802.1x PEAP.
Client is distributed the certificate and the certificate shows the trust as having the appropriate chain.
Thanks
Logon Attempts are receiving this error message:
Log Name:      Security
Source:        Microsoft-Windows-Security-Auditing
Date:          8/8/2014 12:33:35 PM
Event ID:      5061
Task Category: System Integrity
Level:         Information
Keywords:      Audit Failure
User:          N/A
Computer:      SERVER01.domain.lan
Description:
Cryptographic operation.
Subject:
Security ID:
SYSTEM
Account Name:
SERVER01$
Account Domain:
DOMAIN
Logon ID:
0x3E7
Cryptographic Parameters:
Provider Name:
Microsoft Software Key Storage Provider
Algorithm Name:
RSA
Key Name:
KEYNAME
Key Type:
Machine key.
Cryptographic Operation:
Operation:
Decrypt.
Return Code:
0x80090010

Answer 1

It seems the server does not have access to "its own" private key.
Two ideas:
1) The service used with NPS (I guess Network Service)
does not have access to the private key. This service should be given Full Control on the Private Key in the Certificates MMC targeted to the local computer (right-click the cert. in Personal, All Tasks, Manage Keys...)
2) I have generally sometimes seen issues when the Software Key Storage Provider was used with SSL (Schannel error messages...). Using a
classical CSP specifically designed for SSL resolved that, e.g. the RSA Schannel provider. You would need to copy your template again and pick such a CSP ("Windows 2003 template" in case this is a W2K8 (R2) CA or compatible with XP/2003 in
case this is W2K12.
If you use RSA and the same key size as with the Software Key Storage Provider I don't see any higher risk associated with that.
Elke