sn.exe 失败并显示“拒绝访问”错误消息
当我使用强名称工具创建新密钥来签署 .NET 程序集时，我收到“访问被拒绝”错误消息。 这在 Windows XP 机器上工作得很好，但在我的 Vista 机器上却不起作用。
PS C:\users\brian\Dev\Projects\BELib\BELib> sn -k keypair.snk
Microsoft (R) .NET Framework Strong Name Utility Version 3.5.21022.8
Copyright (c) Microsoft Corporation. All rights reserved.
Failed to generate a strong name key pair -- Access is denied.
是什么原因导致此问题以及如何解决它？
您是否正在运行 PowerShell 或 以管理员身份运行命令提示符？ 我 发现这是第一个地方 看看直到您习惯了用户访问 控制或通过打开用户访问权限 控制关闭。
是的，我已经尝试以管理员身份运行 PS 和常规命令提示符。 出现相同的错误消息。
I get an Access is Denied error message when I use the strong name tool to create a new key to sign a .NET assembly. This works just fine on a Windows XP machine but it does not work on my Vista machine.
PS C:\users\brian\Dev\Projects\BELib\BELib> sn -k keypair.snk
Microsoft (R) .NET Framework Strong Name Utility Version 3.5.21022.8
Copyright (c) Microsoft Corporation. All rights reserved.
Failed to generate a strong name key pair -- Access is denied.
What causes this problem and how can I fix it?
Are you running your PowerShell or
Command Prompt as an Administrator? I
found this to be the first place to
look until you get used to User Access
Control or by turning User Access
Control off.
Yes I have tried running PS and the regular command prompt as administrator. The same error message comes up.
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（6）
另一种可能的解决方案可能是您需要授予用户帐户访问位于 C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys 的密钥容器的权限
Another possible solution could be that you need to give your user account access to the key container located at C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys
您是否以管理员身份运行 PowerShell 或命令提示符？ 我发现这是您习惯用户访问控制或关闭用户访问控制之前首先要查看的地方。
Are you running your PowerShell or Command Prompt as an Administrator? I found this to be the first place to look until you get used to User Access Control or by turning User Access Control off.
为什么不启动 sysinternals Process Monitor 看看你能看到什么，这是当我收到任何类型的访问被拒绝消息时我总是做的第一件事？
http://technet.microsoft.com/en-us/sysinternals/bb896645。 ASPX
Why not fire up sysinternals Process Monitor too see what you can see, it's the first thing I always do when I get any kind of access denied message?
http://technet.microsoft.com/en-us/sysinternals/bb896645.aspx
只是更新一下：我在 Vista 上遇到了同样的问题。 我的 PC 上的本地用户没有问题，但后来我们切换到域，我的域用户（尽管具有本地管理员权限）得到“访问被拒绝”。
我将域用户访问权限授予 C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys 并修复了该问题。
Just to update this a bit: I ran into the same problem on Vista. My local user on the PC had no problem but then we switched to a domain and my domain user (albeit having local admin rights) got "Access Denied".
I granted my domain user access rights to C:\Users\All Users\Microsoft\Crypto\RSA\MachineKeys and that fixed it.
有些人重建机器来解决此问题，但可以通过授予用户访问密钥容器 C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys 的权限来解决此问题
使用 sn.exe -i 创建的每个容器都位于 MachineKeys 目录中（除非您在其他地方指定）。 sn.exe 使用的默认密钥容器也位于该位置。
如果您将密钥容器重置为新的，并且忘记了它在哪里..您可以使用 sn.exe -c 重置强名称实用程序的密钥容器。 因此，如果帐户访问修复不起作用，您可能正在使用备用密钥存储，因此可能需要重置。
Some people rebuild their machines to resolve this problem, but it can be solved by giving user access to the key container C:\Documents and Settings\All Users\Application Data\Microsoft\Crypto\RSA\MachineKeys
Each container created using sn.exe -i is located in the MachineKeys directory (unless you specify elsewhere). The default key container that is used by sn.exe is also in that location.
In case you reset your key container to a new one, and forget where it is.. you can reset the key container for the strong name utility using sn.exe -c. So, if the account access fix doesn't work, you may be using an alternate key store so a reset may be in order.
针对 Win 10+ 进行更新：
新路径为：C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
由于 System 是该文件夹的所有者，因此您需要将其更改为具有管理员访问权限的用户或组。 完成此操作后，您可以继续更改“每个人”的读/写权限。
Updating this for Win 10+:
The new path is: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys
Since System is the owner of the folder, you will need to change it to a user or group that has Administrator access. Once you've done this, you can proceed to alter the permission on Everyone to Read/Write.