windows - How to grant an account permissions to access a certificate? -
i have certificate in msmq service personal store , need grant network service permissions access certificate.
the way know of using certutil.exe on win2008/7 so:
certutil -service -service -repairstore msmq\my "" d:pai(a;;ga;;;ba)(a;;ga;;;sy)(a;;gr;;;ns)
however, certutil on win2003/xp not recognize -service parameter, no good.
my question how can in way works both win2003/xp , win2008/7?
i need non interactive approach (command line utility, script, com/.net/win32 api).
if need set acl rights on certificate's private key (which linked page suggests), posted answer here on how found that.
open x509store , current certificate in hand, , set acl on private key.
you can use sid of account needing access (or use well-known sid s-1-5-20 if know it's network service):
ntaccount nt = new ntaccount("nt_authority", "networkservice"); securityidentifier sid = (securityidentifier)nt.translate(typeof(securityidentifier));
my other answer has code sets acl. (caveat: i've run on windows server 2003 not xp.)
Comments
Post a Comment