Application pool fails to start after an OS upgrade or server migration

After an in place Windows Server OS upgrade, a server migration, imaging or cloning, or a restore to new hardware, the Devolutions Server website is unreachable. In IIS, the Devolutions Server application pool will not start, and the Windows Event Log or IIS reports the error Failed to decrypt attribute password.

This is not a Devolutions Server encryption keys problem

The wording mentions decrypt and password, so it is easily mistaken for a loss of the Devolutions Server encryption keys. It is not. This error comes from IIS, not Devolutions Server. Windows keeps the two in separate locations.

What	Location	Belongs to
IIS configuration protection keys (iisConfigurationKey, iisWasKey)	C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys	IIS / Windows
Devolutions Server encryption keys (encryption.config)	C:\ProgramData\Microsoft\Crypto\Protect\S-1-5-18 (DPAPI)	Devolutions Server

IIS encrypts certain attributes in applicationHost.config using the RSA key containers in MachineKeys. When those containers become inaccessible after a machine change, IIS can no longer read the protected attributes and refuses to start the application pool.

Do not use Console – Tools – Import or Recover to fix this symptom. Those tools act on the Devolutions Server encryption keys, a different store that is not the cause here.

Cause

An in place OS upgrade or machine change can leave the IIS RSA key containers in an inaccessible state (permissions, ownership, or provisioning state), even though the rest of the system, including the Devolutions Server encryption keys, is intact. IIS's fix is to regenerate its configuration protection keys.

Before you start

Make a full backup or VM snapshot of the server before modifying anything under Crypto\MachineKeys.

If the Devolutions Server application pool runs under a custom Windows or domain account, have that account's password ready. Regenerating the keys cannot recover the previously stored password, so it must be re entered in IIS afterward. Application pools under a built in identity (for example, ApplicationPoolIdentity) need no password.

Resolution

Regenerate the IIS configuration protection keys, following Microsoft's documented procedure for regenerating the IIS machine or configuration encryption keys.

1. Open an elevated Command Prompt.
2. In C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys, remove the affected IIS key containers (iisConfigurationKey and iisWasKey). On a given machine, these appear as files whose names begin with a machine specific hash prefix.
3. Reset the IIS protected configuration section:

   %windir%\system32\inetsrv\appcmd.exe reset config /section:configProtectedData

1. Restart IIS:

   iisreset

1. If the pool uses a custom account, re enter its credentials in IIS Manager, under Application Pools – (Devolutions Server pool) – Advanced Settings – Process Model – Identity.

IIS regenerates fresh configuration protection keys on restart, and the application pool starts normally.

After the fix: confirm your data

Sign in to Devolutions Server and open an existing entry, then reveal a stored password (or open a saved connection).

• If it works, the encryption keys were unaffected and recovery is complete.
• If stored secrets come back unreadable, the encryption keys were also affected. See Restore a Devolutions Server instance and Manage encryption keys. A pre existing exported keys file or recovery kit is required.

Prevent this in the future

Before any OS upgrade, migration, or hardware change of a Devolutions Server host:

• Export the encryption keys (Console – Tools – Export) and/or generate a recovery kit, and store them securely off the server.
• Back up the SQL database and the web application folder.