10

I am running out of disk space on C:-drive. We see many (millions of) files in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

What are these files ?

Why are so many files created? How can we prevent this from happening? Can these files be deleted?

  • Do you use Comodo firewall? – David Schwartz Jan 18 '13 at 15:14
  • 1
    I'm not quite sure why you have so many. I have 7 files in that location. I don't know what the files are though, so I can't give an answer, just thought I'd let you know so many files may not be normal. – Simkill Jan 18 '13 at 15:14
  • How large are they? Are they even relevant to your space issue? If not, leave them be. – Der Hochstapler Dec 29 '13 at 9:35
5

I have found the answer by some analysis and testing. The problem is caused by SSL checking performed by ESET antivirus software.

Disable SSL scanning in ESET and these files will stop appearing in great quantities.

ESET SSL scanning is also connected to MITM attack warning in Chrome (also see links posted in given Q/A and comments).

  • 3
    ESET does a MITM to decrypt SSL traffic so it can scan the contents. It therefore must generate a fake key for each SSL website you visit so your browser doesn't complain the connection has been compromised. Almost year old question brings into mind the current Lenovo-Superfish-Kommodia debacle where the private key to generate all those faked keys is easy to crack and the error checking is so ludicrous that its key regen will force a self-signed cert to be fully trusted if the cert is generated just right. – Fiasco Labs Mar 1 '15 at 18:50
  • @FiascoLabs – yes I fully agree. This ESET case popped up on my mind when reading about Lenovo-Superfish-Kommodia. – miroxlav Mar 2 '15 at 8:05
  • More recognition of an ESET-related cause: forum.eset.com/topic/… – Kez Feb 13 '18 at 13:17
2

The files are related to SSL certificates issued through the Windows webserver, IIS.

A solution to delete these files is suggested here:

OK so I have found a way to clear down the folder: forfiles /d -90 /C "cmd /c del @file /F /A:AS"

This looks for files older than 90 days and runs cmd - the del command with force option and files with attributes A and S (archive & system). I dont know why it wasn't working without the /A:AS on the end, maybe because they are system files.

Forfiles is a utility to perform batch operations on multiple files.

CAUTION: before you proceed to remove the files, make sure they are not crucial to any production-critical web sites !

  • Also it's always good to have a fresh full backup before mucking about by deleting stuff you might not know the full extend of. my 2c. – Elliptical view Jan 28 '14 at 11:54
  • 4
    if I understand forfiles correctly, your command should contain del @file instead of del *. With del * you do not need forfiles, because del * simply deletes everything... – miroxlav Feb 22 '14 at 22:20
  • 1
    still no answer WHY those files are appearing and how it can be stopped... I have millions, too and I would like to stop their creation. Unaffected systems have up to 100 files there. – miroxlav Apr 17 '14 at 23:48
  • LInk now returns 404 but a similar command can be found here: notes.ponderworthy.com/… - contains breakdown of the command too. Obviously use this only if you know what you're doing. – Kez Feb 13 '18 at 13:16
0

There are four common reasons why the files in the MachineKeys folder are not automatically removed:

  • There is a permission issue that is preventing OS to remove file from that folder. Compare the folder permissions with the ones listed in this document
  • There is a code related issue. The application is not removing X.509 certificates once it uses them for communication. More details
  • A security software might be performing SSL check and causing these files to persist. Try disabling this software
  • Enterprise CA might be failing to respond the request. Check Event Viewer logs for the failed requests

Source: Remove older files in MachineKeys folder

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy