Article ID: 331333 - View products that this article applies to.
This article was previously published under Q331333
When a user tries to use certificate functionality after they change their password or when they use a roaming profile, they may lose access to this certificate functionality. Certificate functionality that may not work as before includes the following:
Schannel Event: 36870
A fatal error occurred when you try to access the SSL client credential private key. The error code returned from the cryptographic module is 0x80090016.
This problem occurs only if the client user account is in a Microsoft Windows NT 4.0 domain and if they are logged on to a Microsoft Windows XP Professional workstation. The Windows XP version of the Data Protection API (DPAPI) function helps to protect EFS private keys and other data that you want to keep secure. The recovery functionality of DPAPI is not supported for users who are members of domains that are running Microsoft Windows NT 4.0 and earlier.
To maintain client access to certificate functionality after users change their passwords or when they use roaming profiles, upgrade the domain to Active Directory directory service. Active Directory domains provide a mechanism that helps to protect the DPAPI master key with a public/private key pair. (The DPAPI master key is used to help protect EFS private keys and other certificate-based functions.)
In a Windows NT 4.0 domain, the ability to restore access to the certificate keys and data is located on the workstation. This is not the case in a Microsoft Windows 2000 domain. Because the recovery mechanism is not located on the workstation, Windows 2000 domains provide a significant additional level of protection for certificates if the workstation is physically compromised.
Although you only have to upgrade a single domain controller to take advantage of the DPAPI domain recovery mechanism, consider upgrading at least two domain controllers for fault-tolerance purposes.
It is highly recommended that you plan your Active Directory before you implement it. For more information about Active Directory design, visit the following Microsoft Web site:
To work around this problem, install Windows XP Service Pack 1 (SP1) or later on the client workstation, and then create the following registry entry to emulate Windows 2000 behavior.
Important This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
322756Follow these steps, and then quit Registry Editor:
(http://support.microsoft.com/kb/322756/ )How to back up and restore the registry in Windows
Note If you work around this problem by editing the registry, you only change the behavior that is described in the Symptoms section from the time that you make the registry change. Any password changes that were made before the change to the registry are not be undone and you will still receive an "access denied" error message when you open the EFS file.
Important security implicationsUsing this registry entry substantially decreases the security of a physically compromised computer. An attacker with physical access to the computer could access some or all EFS-encrypted files and any Certificate private keys on it.
Recover access to the files after a password changeTo regain access to the certificate functionality on an individual workstation after a password change, change the password back to the password that was used when the files were last encrypted.
Note These steps only change the password that you use to log on to your computer. They do not change your domain password.
The behavior that is described in the "Symptoms" section of this article applies only to users who are members of a Windows NT 4.0 domain and who log on to computers that run Windows XP. The behavior of Windows XP Professional clients that are members of a workgroup or of a Windows 2000 Active Directory domain differs significantly from the description in this article.
For more information about DPAPI in Windows XP, visit the following Microsoft Web site:
http://msdn2.microsoft.com/en-us/library/ms995355.aspxFor more information about troubleshooting DPAPI issues, including loss of access to a private key or EFS files, click the following article number to view the article in the Microsoft Knowledge Base:
(http://support.microsoft.com/kb/309408/ )Troubleshooting the Data Protection API (DPAPI)