title: MMC console - certificate private key handling
body: <p>We have an application that needs to access the private key of a certificate. We also have have a Nightlybuild that sets the certificate up (imports it from a pfx file using certmgr). This works really fine as long as the setup of the certificate and the access of the certificate runs under the same logged in Windows user (Windows7).</p>
  
  <p>Now, we would like to introduce a test (that is executed during the Nightlybuild automatically) where another user will invoke the program that needs to access the private key of the certificate and I am struggling with the MMC console -> All Tasks -> Manage Private Keys.</p>
  
  <p>For me it looks like I can change anything in the security settings of "Manage Private keys", but it does not have anything to do with the real ACLs of the certificate. I could reduce the problem to the following manual steps:</p>
  
  <ol>
  <li>User1 imports the certificate into "Local Computer/My" (correct CA in root exists)</li>
  <li>User1 selects the certificate in MMC, clicks on "Manage Private Keys" and adds "Users" (group) and "User2" (user) with Full Control permissions.</li>
  <li>User1 logs out</li>
  <li>User2 logs in</li>
  <li>User2 opens MMC, clicks on "Manage Private Keys" --> Error, the MMC console displays "Cannot find the certificate and private key for decryption."</li>
  </ol>
  
  <p>Although User2 should have access to the private key. So it seems to me that the settings of User1 (both, User1 and User2 are in the Administrators group) in MMC have no meaning whatsoever and are ignored by the .NET API that accesses the private key? </p>
  
  <p>Does anybody have any idea why this is so and how I can try to persuade Windows that we really want two users to be able to read the private key of a certificate?</p>
  
  <p>Thanks for any help
  Michael</p>