Microsoft C:\Windows\System32\Microsoft

Cryptography data of the System account: Crypto and Protect subfolders (DPAPI master keys); not the same as ProgramData\Microsoft\Crypto.

Updated on 12 November 2026 By AltF4 Formation

What it’s for

C:\Windows\System32\Microsoft holds machine-specific cryptography data: Crypto for the System account’s cryptographic keys, and Protect for its DPAPI (data protection) master keys. You meet it mostly in security analysis or in a DPAPI or machine certificate error message.

Do not confuse it with MachineKeys, under %ProgramData%\Microsoft\Crypto\RSA, which stores the key pairs of certificates for the computer and users, with strict permissions to protect private keys.

What it contains

Crypto: cryptographic keys of the System account.
Protect: DPAPI protection data of the System account.
Other subfolders depending on installed components. The folder is generally small.

Risks and best practices

Private keys and system secrets are stored here. Losing them can invalidate machine certificates and encrypted secrets.
Permissions are deliberately restrictive, so do not widen them to “fix” an access denied.
Keep the folder out of copies sent to third parties and out of uncontrolled diagnostic collection.

Useful commands

# NTFS permissions of the folder
Get-Acl "$env:windir\System32\Microsoft" | Format-List Owner, AccessToString

Report a mistake