[SOLVED] Server 2019 TermServLic Service won´t start after windowsupdate

[themoon19]

First I restarted the rds Service, so the Error is listed again.

 

[themoon19]

OK here is the wetransferlink.

EventLogs.zip

 

[Maxstar]

Schlüssel kann nicht in Kryptografie importiert werden. Fehler 5.
Kryptografie kann nicht initialisiert werden - Fehlercode 5.

It seems there is a problem with the permissions of the following directory: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
What is the result of the following command:

icacls "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys"

 

[themoon19]

C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys EveryoneOI)(CI)(RX)
EveryoneR,W)
VORDEFINIERT\AdministratorenF)

1 Dateien erfolgreich verarbeitet, bei 0 Dateien ist ein Verarbeitungsfehler aufgetreten.

Looks good for me.

 

[Maxstar]

It seems the following permissions are missing?

NT AUTHORITY\System:
NT AUTHORITY\NetworkService:

In this post at GitHub, Microsoft published this script to reset the permissions for that folder.

md c:\temp
icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c > c:\temp\BeforeScript_permissions.txt 
takeown /f "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" /a /r
icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c /grant "NT AUTHORITY\System:(F)"
icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c /grant "NT AUTHORITY\NETWORK SERVICE:(R)"
icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c /grant "BUILTIN\Administrators:(F)"
icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c > c:\temp\AfterScript_permissions.txt

 

[themoon19]

Maxstar, you are great, thanks a lot. It worked.

md c:\temp
icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c > c:\temp\BeforeScript_permissions.txt Succeed
takeown /f "C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys" /a /r Succeed
icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c /grant "NT AUTHORITY\SystemF)" Succeed

icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c /grant "NT AUTHORITY\NETWORK SERVICER)"
Mappings of account names and security identifiers were not performed.

icacls C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys /t /c /grant "BUILTIN\AdministratorsF)"
Mappings of account names and security identifiers were not performed.

BUT

the RDS Services starts without errors.

I feel happy.

Thank you, thank you, thank you

 

[Maxstar]

You're welcome and thank you for your kind words! Glad to hear resetting the permissions has fixed this issue.
I'll mark this thread as solved.