Web Apps won't work - Crypto provider access is denied

Question

This is a fresh SharePoint Foundation 2010 install following well documented steps that have worked on other servers.  The OS is 2008 R2.  The error in the log file is the following:
03/19/2011 09:37:58.58  w3wp.exe (0x1428)                        0x1BF4 Excel Services Application     Excel
Calculation Services     d51d Medium   MossHost.CreateServiceChannel<IExcelServiceSoap>: Failed with the following exception: System.Security.Cryptography.CryptographicException: Access is denied.      
at System.Security.Cryptography.CryptographicException.ThrowCryptogaphicException(Int32 hr)     at System.Security.Cryptography.Utils._GenerateKey(SafeProvHandle hProv, Int32 algid, CspProviderFlags flags, Int32 keySize, SafeKeyHandle&
hKey)     at System.Security.Cryptography.Utils.GetKeyPairHelper(CspAlgorithmType keyType, CspParameters parameters, Boolean randomKeyContainer, Int32 dwKeySize, SafeProvHandle& safeProvHandle, SafeKeyHandle& safeKeyHandle)    
at System.Security.Cryptography.RSACryptoServiceProvider.GetKeyPair()     at System.Security.Cryptography.RSACryptoServiceProvider.ExportParameters(Boolean includePrivatePa... cf1ea827-a292-4ddf-a520-d80a781f1b25
The app pool for the "SharePoint Web Services Root" is running under the LocalSystem account.  I have verified that the SYSTEM account has access (full) to all the MachineKeys in the C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys folder.
Any idea on what the permission is causing this problem?
Just as a side note, all the Excel services, web apps activation, etc. have all been confirmed they are setup, running, etc.  No errors are logged in the event log.
Rob

Answer 1

If your application uses impersonation or the IUSR_MACHINENAME user, then configure the MachineKeys folder security rights and give the following rights to the user:
Read & Execute, List Folder Contents, Read, Write
Hi Rob,
From the error message "Security.Cryptography.CryptographicException: Access is denied", we can know this issue was caused by access denied. Based on your description, you known that. It is great.
However, I would like to mention that the Excel Calculation Services is running under another application pool other than the SharePoint Web Services Root. So the application pool account may be different.
Please follow these steps to get the application pool account:
1. Open Internet Information Server(IIS) manager.
2. Expand the site "SharePoint Web Services"
3. Select each application under the site
4. Click "Basic Settings..." from the right panel.
5. Repeat step 3 and 4 till we get the application that has path like C:\Program Files\Microsoft Office Servers\14.0\WebServices\Shared\ExcelCalculationServer from the "Basic Settings"
6. Now, get the application pool name from the "Basic Settings"(Edit applicatoin) dialog.
7. Go to Application pools
8. Select the Excel Calculation Services application pool.
9. click "Advanced Settings" from the right panel.
Now, we can get the application pool account from the "Advanced Setting" dialog.
Please make sure this account has permissions to write key to Machine Keys folder.
Alternatively, use the Process Monitor to monitor which account is used to write file to the machine key folder. We can filter the Result column to check who is denied to access the folder.
If you have any more questions, please feel free to ask.
Thanks,
Jinchun Chen
Jin Chen - MSFT