> For the complete documentation index, see [llms.txt](https://docs.devolutions.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.devolutions.net/server/knowledge-base/troubleshooting-articles/application-pool-fails-to-start-after-an-os-upgrade-or-server-migration.md).

# Application pool fails to start after an OS upgrade or server migration

After an in place Windows Server OS upgrade, a server migration, imaging or cloning, or a restore to new hardware, the Devolutions Server website is unreachable. In IIS, the Devolutions Server application pool will not start, and the Windows Event Log or IIS reports the error ***Failed to decrypt attribute password***.

### This is not a Devolutions Server encryption keys problem

The wording mentions ***decrypt*** and ***password***, so it is easily mistaken for a loss of the Devolutions Server encryption keys. It is not. This error comes from IIS, not Devolutions Server. Windows keeps the two in separate locations.

| What                                                                       | Location                                                   | Belongs to         |
| -------------------------------------------------------------------------- | ---------------------------------------------------------- | ------------------ |
| **IIS configuration protection keys** (`iisConfigurationKey`, `iisWasKey`) | `C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys`          | IIS / Windows      |
| **Devolutions Server encryption keys** (`encryption.config`)               | `C:\ProgramData\Microsoft\Crypto\Protect\S-1-5-18` (DPAPI) | Devolutions Server |

IIS encrypts certain attributes in `applicationHost.config` using the RSA key containers in `MachineKeys`. When those containers become inaccessible after a machine change, IIS can no longer read the protected attributes and refuses to start the application pool.

{% hint style="warning" %}
 Do not use ***Console*** – ***Tools*** – ***Import*** or ***Recover*** to fix this symptom. Those tools act on the Devolutions Server encryption keys, a different store that is not the cause here. 
{% endhint %}

### Cause

An in place OS upgrade or machine change can leave the IIS RSA key containers in an inaccessible state (permissions, ownership, or provisioning state), even though the rest of the system, including the Devolutions Server encryption keys, is intact. IIS's fix is to regenerate its configuration protection keys.

### Before you start

Make a full backup or VM snapshot of the server before modifying anything under `Crypto\MachineKeys`.

If the Devolutions Server application pool runs under a custom Windows or domain account, have that account's password ready. Regenerating the keys cannot recover the previously stored password, so it must be re entered in IIS afterward. Application pools under a built in identity (for example, `ApplicationPoolIdentity`) need no password.

### Resolution

Regenerate the IIS configuration protection keys, following Microsoft's documented procedure for regenerating the IIS machine or configuration encryption keys.

1. Open an elevated Command Prompt.
2. In `C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys`, remove the affected IIS key containers (`iisConfigurationKey` and `iisWasKey`). On a given machine, these appear as files whose names begin with a machine specific hash prefix.
3. Reset the IIS protected configuration section:

```
   %windir%\system32\inetsrv\appcmd.exe reset config /section:configProtectedData
```

4. Restart IIS:

```
   iisreset
```

5. If the pool uses a custom account, re enter its credentials in IIS Manager, under ***Application Pools*** – ***(Devolutions Server pool)*** – ***Advanced Settings*** – ***Process Model*** – ***Identity***.

IIS regenerates fresh configuration protection keys on restart, and the application pool starts normally.

### After the fix: confirm your data

Sign in to Devolutions Server and open an existing entry, then reveal a stored password (or open a saved connection).

* If it works, the encryption keys were unaffected and recovery is complete.
* If stored secrets come back unreadable, the encryption keys were also affected. See Restore a Devolutions Server instance and Manage encryption keys. A pre existing exported keys file or recovery kit is required.

### Prevent this in the future

Before any OS upgrade, migration, or hardware change of a Devolutions Server host:

* Export the encryption keys (***Console*** – ***Tools*** – ***Export***) and/or generate a recovery kit, and store them securely off the server.
* Back up the SQL database and the web application folder.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.devolutions.net/server/knowledge-base/troubleshooting-articles/application-pool-fails-to-start-after-an-os-upgrade-or-server-migration.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.