13

I am running out of disk space on C:-drive. We see many (millions of) files in C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys

What are these files ?

Why are so many files created? How can we prevent this from happening? Can these files be deleted?

Improve this question
3
  • Do you use Comodo firewall?
    – David Schwartz
    Jan 18, 2013 at 15:14
  • 1
    I'm not quite sure why you have so many. I have 7 files in that location. I don't know what the files are though, so I can't give an answer, just thought I'd let you know so many files may not be normal.
    – Simkill
    Jan 18, 2013 at 15:14
  • How large are they? Are they even relevant to your space issue? If not, leave them be.
    – Oliver Salzburg
    Dec 29, 2013 at 9:35

3 Answers 3

Reset to default
5

I have found the answer by some analysis and testing. The problem is caused by SSL checking performed by ESET antivirus software.

Disable SSL scanning in ESET and these files will stop appearing in great quantities.

ESET SSL scanning is also connected to MITM attack warning in Chrome (also see links posted in given Q/A and comments).

Improve this answer
3
  • 3
    ESET does a MITM to decrypt SSL traffic so it can scan the contents. It therefore must generate a fake key for each SSL website you visit so your browser doesn't complain the connection has been compromised. Almost year old question brings into mind the current Lenovo-Superfish-Kommodia debacle where the private key to generate all those faked keys is easy to crack and the error checking is so ludicrous that its key regen will force a self-signed cert to be fully trusted if the cert is generated just right.
    – Fiasco Labs
    Mar 1, 2015 at 18:50
  • @FiascoLabs – yes I fully agree. This ESET case popped up on my mind when reading about Lenovo-Superfish-Kommodia.
    – miroxlav
    Mar 2, 2015 at 8:05
  • More recognition of an ESET-related cause: forum.eset.com/topic/…
    – Kez
    Feb 13, 2018 at 13:17
3

The files are related to SSL certificates issued through the Windows webserver, IIS.

A solution to delete these files is suggested here:

OK so I have found a way to clear down the folder: forfiles /d -90 /C "cmd /c del @file /F /A:AS"

This looks for files older than 90 days and runs cmd - the del command with force option and files with attributes A and S (archive & system). I dont know why it wasn't working without the /A:AS on the end, maybe because they are system files.

Forfiles is a utility to perform batch operations on multiple files.

CAUTION: before you proceed to remove the files, make sure they are not crucial to any production-critical web sites !

Improve this answer
4
  • Also it's always good to have a fresh full backup before mucking about by deleting stuff you might not know the full extend of. my 2c.
    – Elliptical view
    Jan 28, 2014 at 11:54
  • 4
    if I understand forfiles correctly, your command should contain del @file instead of del *. With del * you do not need forfiles, because del * simply deletes everything...
    – miroxlav
    Feb 22, 2014 at 22:20
  • 1
    still no answer WHY those files are appearing and how it can be stopped... I have millions, too and I would like to stop their creation. Unaffected systems have up to 100 files there.
    – miroxlav
    Apr 17, 2014 at 23:48
  • LInk now returns 404 but a similar command can be found here: notes.ponderworthy.com/… - contains breakdown of the command too. Obviously use this only if you know what you're doing.
    – Kez
    Feb 13, 2018 at 13:16
2

There are four common reasons why the files in the MachineKeys folder are not automatically removed:

  • There is a permission issue that is preventing OS to remove file from that folder. Compare the folder permissions with the ones listed in this document
  • There is a code related issue. The application is not removing X.509 certificates once it uses them for communication. More details
  • A security software might be performing SSL check and causing these files to persist. Try disabling this software
  • Enterprise CA might be failing to respond the request. Check Event Viewer logs for the failed requests

Source: Remove older files in MachineKeys folder

Improve this answer

You must log in to answer this question.