Home/ Questions/Q 4042726
In Process

The Archive Base Latest Questions

Editorial Team
  • 0
Asked: 2026-05-20T13:02:28+00:00

The Windows MMC Certificates snap-in lets an Administrator work with Service account, but how

  • 0

The Windows MMC Certificates snap-in lets an Administrator work with “Service account”, but how are those certificates accessed by a service?

If I import to Personal as an Administrator using “Service account”, and my service running as a standard user looks in StoreLocation.CurrentUser (or StoreLocation.LocalMachine) using System.Security.Cryptography.X509Certificates.X509Store, it does not find the certificate.

If instead I logon as the service account and import the certificate to Personal from that standard user account, then the certificate is found by the service.

Where does the snap-in put the certificate for “Service account”, and how does a service find it using the .NET classes?

Share

Leave an answer

You must login to add an answer.

Need An Account,

1 Answer

  1. Editorial Team

    The certificates are stored in the registry under HKLM. For example, if the service name is MYSERVICE then the Personal store certificates are here:

    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\Services\MYSERVICE\SystemCertificates\My\Certificates]

    This MSDN page has more details: System Store Locations

    I don’t see where the private key is held — perhaps in the blob data. To access this store from .NET I would have to P/Invoke (cf. here.)

    I don’t plan to use the “Service account” so I’m not looking further.

    • 0