<p>I am running into an issue I had before; can't find my reference on how to solve it.</p>

<p>Here is the issue. We encrypt the connection strings section in the app.config for our client application using code below:</p>

<pre><code>        config = ConfigurationManager.OpenExeConfiguration(ConfigurationUserLevel.None)
        If config.ConnectionStrings.SectionInformation.IsProtected = False Then
            config.ConnectionStrings.SectionInformation.ProtectSection(Nothing)

            ' We must save the changes to the configuration file.'
            config.Save(ConfigurationSaveMode.Modified, True)
        End If
</code></pre>

<p>The issue is we had a salesperson leave. The old laptop is going to a new salesperson and under the new user's login, when it tries to to do this we get an error. The error is:</p>

<pre><code>Unhandled Exception: System.Configuration.ConfigurationErrorsException: 
An error occurred executing the configuration section handler for connectionStrings. ---&gt; System.Configuration.ConfigurationErrorsException: Failed to encrypt the section 'connectionStrings' using provider 'RsaProtectedConfigurationProvider'. 
Error message from the provider: Object already exists.
---&gt; System.Security.Cryptography.CryptographicException: Object already exists
</code></pre>

[{'answer_id': 42206, 'author': 'Booji Boy', 'author_id': 1433, 'author_profile': 'https://Stackoverflow.com/users/1433', 'pm_score': 0, 'selected': False, 'text': '<p>Sounds like a permissions issue. The (new) user in question has write permissions to the app.config file? Was the previous user a local admin or power user that could have masked this problem? </p>\n'}, {'answer_id': 42213, 'author': 'MikeScott8', 'author_id': 1889, 'author_profile': 'https://Stackoverflow.com/users/1889', 'pm_score': 1, 'selected': False, 'text': '<p>So I did get it working.</p>\n\n<ol>\n<li>removed old users account from laptop</li>\n<li>reset app.config to have section not protected</li>\n<li>removed key file from all users machine keys</li>\n<li>ran app and allowed it to protect the section</li>\n</ol>\n\n<p>But all this did was get it working for this user.</p>\n\n<p>NOW I need to know what I have to do to change the code to protect the section so that multiple users on a PC can use the application. Virtual PC here I come (well after vacation to WDW tomorrow through next Wednesday)!</p>\n\n<p>any advice to help pointing me in right direction, as I am not very experienced in this RSA encryption type stuff.</p>\n'}, {'answer_id': 373205, 'author': 'MikeScott8', 'author_id': 1889, 'author_profile': 'https://Stackoverflow.com/users/1889', 'pm_score': 2, 'selected': True, 'text': '<p>I found a more elegant solution that in my original answer to myself. I found if I just logged in as th euser who orignally installed the application and caused the config file connectionstrings to be encrypted and go to the .net framework directory in a commadn prompt and run </p>\n\n<pre><code>aspnet_regiis -pa "NetFrameworkConfigurationKey" "{domain}\\{user}"\n</code></pre>\n\n<p>it gave the other user permission to access the RSA encryption key container and it then works for the other user(s).</p>\n\n<p>Just wanted to add it here as I thought I had blogged this issue on our dev blog but found it here, so in case I need to look it up again it will be here. Will add link to our dev blog point at this thread as well. </p>\n'}, {'answer_id': 2702297, 'author': 'luisfbn', 'author_id': 324647, 'author_profile': 'https://Stackoverflow.com/users/324647', 'pm_score': 2, 'selected': False, 'text': '<p><a href="http://blogs.msdn.com/mosharaf/archive/2005/11/17/protectedConfiguration.aspx#1657603" rel="nofollow noreferrer">http://blogs.msdn.com/mosharaf/archive/2005/11/17/protectedConfiguration.aspx#1657603</a></p>\n\n<p>copy and paste :D</p>\n\n<p>Monday, February 12, 2007 12:15 AM by Naica</p>\n\n<p><strong>re: Encrypting configuration files using protected configuration</strong></p>\n\n<p>Here is a list of all steps I\'ve done to encrypt two sections on my PC and then deploy it to the WebServer. Maybe it will help someone...:</p>\n\n<ol>\n<li><p>To create a machine-level RSA key container</p>\n\n<pre><code>aspnet_regiis -pc "DataProtectionConfigurationProviderKeys" -exp\n</code></pre></li>\n<li><p>Add this to web.config before connectionStrings section:</p>\n\n<p></p>\n\n<p></p>\n\n<p></p>\n\n<pre><code> &lt;add name="DataProtectionConfigurationProvider"\n\n      type="System.Configuration.RsaProtectedConfigurationProvider, System.Configuration, Version=2.0.0.0,\n\n               Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a,\n\n               processorArchitecture=MSIL"\n\n      keyContainerName="DataProtectionConfigurationProviderKeys"\n\n      useMachineContainer="true" /&gt;\n</code></pre>\n\n<p></p>\n\n<p></p>\n\n<p>Do not miss the <code>&lt;clear /&gt;</code> from above! Important when playing with encrypting/decrypting many times</p></li>\n<li><p>Check to have this at the top of Web.Config file. If missing add it:</p>\n\n<pre><code>&lt;configuration xmlns="http://schemas.microsoft.com/.NetConfiguration/v2.0"&gt;\n</code></pre></li>\n<li><p>Save and close Web.Config file in VS (very important!)</p></li>\n<li><p>In Command Prompt (my local PC) window go to:</p>\n\n<blockquote>\n  <p>C:\\WINNT\\Microsoft.NET\\Framework\\v2.0.50727</p>\n</blockquote></li>\n<li><p>Encrypt: (Be aware to Change physical path for your App, or use -app option and give the name o virtual directory for app! Because I used VS on my PC I preferred the bellow option. The path is the path to Web.config file)</p>\n\n<p>aspnet_regiis -pef "connectionStrings" "c:\\Bla\\Bla\\Bla" -prov "DataProtectionConfigurationProvider"</p>\n\n<p>aspnet_regiis -pef "system.web/membership" "c:\\Bla\\Bla\\Bla" -prov "DataProtectionConfigurationProvider"</p></li>\n<li><p>To Decrypt (if needed only!):</p>\n\n<pre><code>aspnet_regiis -pdf "connectionStrings" "c:\\Bla\\Bla\\Bla"\n\naspnet_regiis -pdf "system.web/membership" "c:\\Bla\\Bla\\Bla"\n</code></pre></li>\n<li><p>Delete Keys Container (if needed only!)</p>\n\n<pre><code>aspnet_regiis -pz "DataProtectionConfigurationProviderKeys"\n</code></pre></li>\n<li><p>Save the above key to xml file in order to export it from your local PC to the WebServer (UAT or Production)</p>\n\n<pre><code>aspnet_regiis -px "DataProtectionConfigurationProviderKeys" \\temp\\mykeyfile.xml -pri\n</code></pre></li>\n<li><p>Import the key container on WebServer servers:</p>\n\n<pre><code>aspnet_regiis -pi "DataProtectionConfigurationProviderKeys" \\temp\\mykeyfile.xml\n</code></pre></li>\n<li><p>Grant access to the key on the web server</p>\n\n<pre><code>aspnet_regiis -pa "DataProtectionConfigurationProviderKeys" "DOMAIN\\User"\n</code></pre>\n\n<p>See in IIS the ASP.NET user or use:</p>\n\n<pre><code>Response.Write(System.Security.Principal.WindowsIdentity.GetCurrent().Name\n</code></pre></li>\n<li><p>Remove Grant access to the key on the web server (Only if required!)</p>\n\n<pre><code>aspnet_regiis -pr "DataProtectionConfigurationProviderKeys" "Domain\\User"\n</code></pre></li>\n<li><p>Copy and Paste to WebServer the encrypted Web.config file.</p></li>\n</ol>\n'}]
['https://Stackoverflow.com/questions/42115', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1889/']