sn.exe fails with Access Denied error message

Question

I get an Access is Denied error message when I use the strong name tool to create a new key to sign a .NET assembly. This works just fine on a Windows XP machine but it does not work on my Vista machine.

PS C:\users\brian\Dev\Projects\BELib\BELib> sn -k keypair.snk

Microsoft (R) .NET Framework Strong Name Utility  Version 3.5.21022.8
Copyright (c) Microsoft Corporation.  All rights reserved.

Failed to generate a strong name key pair -- Access is denied.

What causes this problem and how can I fix it?

Answer 1

Are you running your PowerShell or Command Prompt as an Administrator? I found this to be the first place to look until you get used to User Access Control or by turning User Access Control off.

Answer 2

Are you running your PowerShell or Command Prompt as an Administrator? I found this to be the first place to look until you get used to User Access Control or by turning User Access Control off.

Yes I have tried running PS and the regular command prompt as administrator. The same error message comes up.

Answer 3

Yes I have tried running PS and the regular command prompt as administrator. The same error message comes up.

Another possible solution could be that you need to give your user account access to the key container located at C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys

Answer 4

Why not fire up sysinternals Process Monitor too see what you can see, it's the first thing I always do when I get any kind of access denied message?

http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx

Answer 5

Some people rebuild their machines to resolve this problem, but it can be solved by giving user access to the key container C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys Each container created using sn.exe -i is located in the MachineKeys directory (unless you specify elsewhere). The default key container that is used by sn.exe is also in that location.

In case you reset your key container to a new one, and forget where it is.. you can reset the key container for the strong name utility using sn.exe -c. So, if the account access fix doesn't work, you may be using an alternate key store so a reset may be in order.

Answer 6

Just to update this a bit: I ran into the same problem on Vista. My local user on the PC had no problem but then we switched to a domain and my domain user (albeit having local admin rights) got "Access Denied". I granted my domain user access rights to C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys and that fixed it.