Skip to contentGo to the directory tree
Windows Directory Tree
  1. C:
  2. ProgramData
  3. Microsoft
  4. Crypto
FolderRisk: Do not touch

Crypto C:\ProgramData\Microsoft\Crypto

Folder of the computer's cryptographic keys (CryptoAPI and CNG stores, including RSA\MachineKeys); never modify it or copy its content.

Updated on By AltF4 Formation

What it’s for

The private keys of the computer’s certificates are stored here: the IIS TLS certificate, Remote Desktop, certificate authentication, among others. CryptoAPI and CNG (Cryptography API: Next Generation) read this folder; if it is lost or its permissions change, those services stop working.

What it contains

One subfolder per provider or key type. The best known is RSA\MachineKeys, where each of the machine’s RSA private keys is a file with a hexadecimal name. The computer’s CNG keys sit alongside, in Keys. These files are protected blobs, unreadable as they are.

To find out which file belongs to which certificate, certutil -store My <thumbprint> prints the “Unique container name”, which is the key file’s name.

Risks and best practices

  • Never copy, move or delete these files: a lost private key makes the certificate unusable, and a copied one compromises it.
  • The MachineKeys permissions are special and documented by Microsoft. If they were changed (typical symptoms: Remote Desktop or TLS errors), restore them from that documentation, not by trial and error.
  • Manage certificates with certlm.msc or the Cert: drive. Export a private key only when you must, with a strong password, and delete the export afterwards.
  • Choose non-exportable keys, and a TPM or HSM where possible.

Useful commands

Fenêtre de terminal
# Computer certificates and private key indicator
Get-ChildItem Cert:\LocalMachine\My | Select-Object Subject, Thumbprint, NotAfter, HasPrivateKey


# Certificate detail, including key provider and key file (Unique container name)
certutil -store My <thumbprint>


# MachineKeys folder permissions (read-only)
icacls "$env:ProgramData\Microsoft\Crypto\RSA\MachineKeys"

Report a mistake