The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →The IIS Complete Certificate Request error usually means Windows cannot use the private key created for the certificate request, or that an enterprise CA rejected the enrollment connection. The common HRESULT is 0x80070005 (E_ACCESSDENIED).
First identify the stage: generating a CSR, applying an issued certificate response, or enrolling through Active Directory Certificate Services (AD CS). CSR and completion failures are normally local MachineKeys-permission or duplicate-install problems; AD CS failures require checking GPO, network logon rights, DCOM, RPC and CA-side authorization. Work through the matching branch below rather than repeatedly importing the same response.
As an Amazon Associate I earn from qualifying purchases.
What “Complete Certificate Request” access denied means
IIS uses a certificate request (CSR) and its private key as a pair. The CA returns a signed certificate response containing the public certificate, and IIS must associate that response with the private key already stored on the server. Windows protects those private-key files in the machine cryptographic store. If the account performing the operation cannot access the relevant file, IIS reports an access-denied error even though the CSR itself may have been created successfully.
Free tools Windows power users keep installed
One-click scans. No signup required.
The same wording can appear at different points in the process. Use the stage and evidence to choose the fix:
#1 Best Overall
| Where it fails | Typical evidence | Primary boundary to check |
|---|---|---|
| Generate a certificate request | IIS says “Failed to generate the certificate request. Access is denied.” No CA response exists yet. | Local permissions on the Windows RSA MachineKeys directory. |
| Complete an issued request | IIS or a certificate wizard reports “Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED)).” | Whether the response was already applied, plus MachineKeys permissions and the private-key association. |
| Enterprise AD CS enrollment | Templates can be found through LDAP, but the CA’s RPC/DCOM call returns access denied. Logs may show MSRPC status 0x5, DistributedCOM Event ID 10027, or auto-enrollment Event ID 82. |
GPO user rights, CA local groups, DCOM permissions, RPC policy and registry settings. |
An RPC availability message is a different clue. Microsoft documents 0x800706ba as “The RPC server is unavailable” (WIN32 1322), which points toward connectivity or RPC availability rather than the local private-key ACL alone.
Capture evidence before changing permissions
Record the exact text and HRESULT from the dialog or event log. A distinction between 0x80070005 and 0x800706ba prevents you from changing a local ACL when the actual problem is an unavailable CA.
- Write down the server name, the account that opened IIS Manager, and whether the operation was started from IIS Manager, an enrollment wizard, or auto-enrollment.
- Note whether a CA has already issued a response. A CSR-generation failure happens before an issued certificate exists; a completion failure happens after issuance.
- For AD CS, save the CA System and Application event entries and, when available, the RPC trace that identifies the failing principal and status.
- Do not repeatedly import the same response while investigating. Repeated attempts can obscure whether it has already been paired with the private key.
Fix A: CSR generation fails with access denied
1. Open the correct MachineKeys directory
Microsoft’s IIS troubleshooting guidance describes the legacy location as Documents and SettingsAll UsersApplication DataMicrosoftCryptoRSAMachineKeys. On current Windows installations, inspect the corresponding directory at C:ProgramDataMicrosoftCryptoRSAMachineKeys. The latter is the path normally present on modern Windows Server systems, while the legacy spelling may appear in older documentation or migrated installations.
Use File Explorer with administrative rights, or navigate directly to the current path. You are checking the RSA directory that stores machine-level private-key files, not an arbitrary IIS content folder.
2. Correct the ACL with the smallest justified change
- Right-click the
MachineKeysfolder and select Properties. - Open the Security tab and review Advanced permissions. Preserve inherited entries and the existing Windows system permissions.
- Grant the administrator account or the appropriate administrators group Full Control over the folder contents, including the files and subfolders, as directed by Microsoft’s documented fix.
- Apply the change to the contents rather than replacing the entire security descriptor. Do not use a blanket Everyone: Full Control entry or remove system and inherited permissions to make the error disappear.
- Close the property dialogs and retry IIS Manager > Server Certificates > Create Certificate Request once.
The objective is to restore the account’s ability to create and use the key files while leaving the machine cryptographic store’s system and inherited ACLs intact. If your organization uses a dedicated enrollment identity, have the security administrator confirm which account should own the operation before changing its permissions.
Rank #2
3. If generation still fails
Recheck that you edited the active MachineKeys directory for that server and that the permission was applied to existing contents, not just displayed on the parent folder. Confirm that the account running IIS Manager is the account whose access you corrected. If the server is managed by a security baseline or domain policy, have the policy owner check whether it is restoring the original ACL after your change.
Do not proceed to certificate completion until a new CSR can be generated successfully. A CA response cannot repair a request that never created a usable private key.
Fix B: an issued certificate response cannot be completed
1. Confirm whether the response was already installed
DigiCert documents the exact HRESULT message Access is denied. (Exception from HRESULT: 0x80070005 (E_ACCESSDENIED))
and notes that applying a public-key or certificate response a second time can trigger it. The first application pairs the response with the existing private key and can change the key file’s permissions. A second import may therefore be rejected even though the original installation succeeded.
- In IIS Manager, open Server Certificates and look for the certificate issued for the request’s subject and validity period.
- Check your certificate-management view to confirm that the installed certificate reports an associated private key. Also compare the subject, subject alternative names (SANs), issuer and intended key usage with the request you submitted.
- If the correct certificate is already present with its private key, use that certificate for the site binding instead of running Complete Certificate Request again.
Keep the original response file and the request details while you verify the association, but do not keep re-importing the same file. Multiple attempts make it harder to tell a duplicate-install condition from a genuine permission failure.
2. Inspect MachineKeys permissions
If the response has not been installed, or the existing certificate has no usable private key, inspect C:ProgramDataMicrosoftCryptoRSAMachineKeys using the same ACL approach described in Fix A. DigiCert identifies this directory as a permission checkpoint for completion failures as well. Preserve inherited and system entries, and make only the administrator or approved enrollment identity correction required by your policy.
3. Recreate the request only when necessary
If the response was applied to a different request, the private key was lost, or the certificate and key cannot be paired, stop importing the old response. Follow your organization’s change procedure to remove the unusable request or certificate and create a new CSR, then submit that CSR to the CA. A new request creates a new private key; it does not retroactively attach an old response to a different key.
Recommended Free Tools
Before recreating anything, obtain approval if the certificate is production-facing. Record the current IIS bindings, certificate thumbprint, subject/SAN list and expiration date so the replacement can be rolled back if necessary.
Fix C: enterprise AD CS enrollment is denied
This branch applies when a domain-joined client can discover certificate templates through LDAP, but the subsequent RPC/DCOM call to the certification authority returns ACCESS DENIED. Microsoft’s current AD CS guidance describes traces with MSRPC status 0x5, CA DistributedCOM Event ID 10027 containing ANONYMOUS LOGON, and auto-enrollment Event ID 82. These symptoms point to the remote security boundary rather than only the local IIS MachineKeys folder.
1. Identify the winning computer policy on the CA
- Log on to the certification authority with an account authorized to inspect policy.
- Run
gpresult /h appliedgpo.html. - Open the generated report and follow Computer Configuration > Windows Settings > Security Settings > Local Policies > User Rights Assignment.
- Identify the winning GPO and determine whether it permits the enrolling user or computer account to reach the CA.
Checking the winning GPO matters because a local setting can appear correct while a higher-precedence domain policy silently replaces it.
2. Check network logon rights
In the winning policy, verify that the enrolling identity is allowed by Access this computer from the network. Also verify that it is not included in Deny access to this computer from the network. A deny assignment takes precedence and can produce an authorization failure even when the account is otherwise valid.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsRank #4
Make changes through the organization’s GPO process. These rights affect every service exposed by the CA, not just certificate enrollment.
3. Verify the CA’s local group membership
On the CA, inspect the local Users group and confirm that expected defaults are present, including NT AUTHORITYAuthenticated Users where applicable to your deployment. Then inspect the local Certificate Service DCOM Access group and verify that NT AUTHORITYAuthenticated Users is present when your enrollment design requires it.
Do not add broad identities merely to suppress an error. Compare the membership with a known-good CA in the same security baseline and document every change.
4. Check Component Services COM security
- Open Component Services > Computers > My Computer.
- Open Properties and select COM Security.
- Under the access and launch permissions, verify that Certificate Service DCOM Access has Local Access and Remote Access.
- Verify that it also has Local Activation and Remote Activation.
These permissions govern the DCOM leg that follows template discovery. A successful LDAP lookup does not prove that the RPC/DCOM call is authorized.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall5. Verify EnableDCOM on both ends
On the client and the CA server, inspect HKEY_LOCAL_MACHINESoftwareMicrosoftOLE and confirm that EnableDCOM is set to Y. Microsoft directs changing an N value to Y and restarting the computer. Coordinate this registry change and the restart with the server owner, because it changes a machine-wide COM security setting.
6. Review unauthenticated RPC restrictions and DCOM hardening
Review the winning policy for Restrictions for Unauthenticated RPC Clients. Modern DCOM authentication-integrity requirements can expose an existing mismatch in authentication or logon rights. Compare the client and CA policy versions, then correct the least-permissive setting that still meets your security standard rather than disabling protections globally.
7. Reproduce once and collect the matching evidence
After the targeted policy or permission correction has applied, retry enrollment once. Collect the updated CA System and Application events, the client auto-enrollment event if present, and an RPC trace when available. The successful path should show the intended enrolling principal rather than ANONYMOUS LOGON, and the issued certificate should have the expected private key, subject/SAN and enhanced key usage.
Choosing the correct branch
| Question | Generation branch | Completion branch | Enterprise enrollment branch |
|---|---|---|---|
| Does an issued CA response exist? | No. | Yes, or an existing certificate may already be installed. | Usually a CA is contacted during enrollment or auto-enrollment. |
| Where is the security boundary? | Local filesystem and private-key creation. | Local private-key association and duplicate-install state. | Remote CA, RPC/DCOM and domain policy. |
| Which identity is relevant? | The administrator or account creating the CSR. | The account completing the response and the key’s existing owner. | The enrolling user or computer account, plus CA-side groups. |
| Most useful evidence | MachineKeys ACL and the IIS generation message. | Installed-certificate state, private-key association and MachineKeys ACL. | gpresult, CA events, DCOM Event ID 10027, auto-enrollment Event ID 82 and RPC status. |
Verification checklist after the fix
- The exact original error and HRESULT are recorded for the change record.
- You corrected only the stage that failed instead of changing unrelated IIS or CA settings.
- The MachineKeys ACL retains inherited and system entries, with Full Control granted only to the approved administrator or enrollment identity where required.
- The certificate response was not imported a second time after it was already paired with a private key.
- For AD CS, the winning GPO permits network access, does not deny it, and the CA’s local groups and COM Security permissions match the intended enrollment design.
EnableDCOMisYon both client and CA when that setting is required, and any required restart has completed.- A single retry succeeds and the resulting certificate shows the intended subject, SAN, enhanced key usage and private-key association.
- The IIS site binding points to the verified certificate, and the old certificate is retained until the replacement has been tested and approved.
Common mistakes that prolong the error
Changing the wrong folder
Older instructions may show the legacy Documents and Settings path. On a current installation, verify the active C:ProgramDataMicrosoftCryptoRSAMachineKeys location before editing permissions. Changing an unrelated application directory will not grant access to the private key.
Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Repair Windows errors before they cause bigger problemsFix Now →Granting excessive permissions
Giving Everyone full control can conceal the immediate symptom while weakening every machine-level RSA key on the server. Preserve system and inherited ACLs and make the narrow correction your administrator or security team approves.
Assuming template discovery proves enrollment works
LDAP template discovery and RPC/DCOM authorization are separate operations. A client can list templates and still be rejected by the CA’s network logon, group or COM security settings.
Confusing access denied with unavailable RPC
0x80070005 indicates access denied; 0x800706ba indicates that the RPC server is unavailable. Capture the exact code before changing permissions, firewall rules or DCOM policy.
Repeating an import without checking state
If the response has already been applied, repeated imports do not repair the association. Find the existing certificate and private key first; recreate the request only when the original key or pairing is unusable and the change is approved.
Quick Recap
As an optional shortcut for local Windows diagnostics, Outbyte PC Repair can check and address more than 100 common Windows issues, including broken system elements and shared DLL problems, and it includes settings, cleanup, privacy and vulnerability checks. It complements antivirus software rather than replacing it; results vary and no utility repairs every crash. It runs on Windows 11, 10, 8 and 7, with a free trial of at least two days by category followed by a paid subscription.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
