Plesk login page is not accessible: Failed to decrypt attribute ‘password’ because the keyset does not exist

Symptoms

Plesk login page shows one of the following error messages:

HTTP Error 500.19 - external Server Error
Error Code 0x8007000d
Config Error Failed to decrypt attribute 'password' because the keyset does not exist

Keyset does not exist (Exception from HRESULT: 0x80090016)

Cause

Insufficient permissions on the files:

• 
%ALLUSERSPROFILE%MicrosoftCryptoRSAMachineKeys6de9cb26d2b98c01ec4e9e8b34824aa2_*

• 
%ALLUSERSPROFILE%MicrosoftCryptoRSAMachineKeys76944fb33636aeddb9590521c2e8815a_*


Resolution

1. Connect to the Plesk server via RDP.

2. Open the folder %ALLUSERSPROFILE%MicrosoftCryptoRSAMachineKeys.

   Note: Displaying of hidden files and protected system files should be enabled in Windows Control Panel > Folder Options.

3. Find files with the names that start with 6de9cb26d2b98c01ec4e9e8b34824aa2_ and 76944fb33636aeddb9590521c2e8815a_.

4. Check access permissions on these files (right-click on a file > Properties > Security tab).

   Here are the correct permissions:

   System, Administrators, TrustedInstaller - Full control
   IIS_IUSR, WMSVC - Read
   LOCAL SERVICE (if available) - Read

If the issue still persists, apply the following steps:

1. Start a command prompt as an Administrator.

2. Obtain a GUID:

   C:> reg query "HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptography" | findstr MachineGuid

3. Verify that the files have names 6de9cb26d2b98c01ec4e9e8b34824aa2_GUID and
76944fb33636aeddb9590521c2e8815a_GUID.

   Example:

   If a GUID is:

   C:> reg query "HKEY_LOCAL_MACHINESOFTWAREMicrosoftCryptography" | findstr MachineGuid
   MachineGuid REG_SZ 40c6fa54-0d9a-45ae-91c5-e85eb36dcbd2

   then files will have names:

   • 6de9cb26d2b98c01ec4e9e8b34824aa2_40c6fa54-0d9a-45ae-91c5-e85eb36dcbd2

   • 76944fb33636aeddb9590521c2e8815a_40c6fa54-0d9a-45ae-91c5-e85eb36dcbd2

4. Restart IIS using the following command in a command-prompt:

   C:> iisreset