Cryptographic Services failed while processing the OnIdentity() call

Hallo thekochs,

auch ich hatte keine S: -Gruppe am Ende, habe (A;;CCLCSWLOCRRC;;;SU) einfach ganz ans Ende gesetzt..

(siehe mein Beispiel)  ..und es funktioniert.

Warum willst du den String erweitern um ??

(A ;; CC ;;; S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459)

..und in deinem Beispiel mit sdset, fehlt auch am Anfang das D:

sc sdset MSLLDPD:(D ;; CCDCLCSWRPWPDTLOCRSDRCWDWO ;;; BG) (A ;; CCDCLCSWRPWPDTLOCRSDR .....

......

Warum nicht einfach ?

sc sdset MSLLDP

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A ;; CCLCSWLOCRRC ;;; SU)

bitte den String nich einfach übernehmen, sondern dein Origial erweitern.

Aber vorher ein Disk-Backup machen!

As you have discovered, accesschk is NOT part of W10 OS

So far as your addition, you are adding a lot more to your MSLLDP than I did, and you have also removed the D: at the beginning.  I'm not versed well enough in this stuff to comment as to what the effects of removing the initial D:

It does appear that you are adding Fearless's fix rather the one in the response marked answer, and that is probably a good thing.

RonRosenfeld,

Thx for your inputs.....and agreed....in fact I'm freaked out about all of this.

Questions...........

I would have assumed Accesschk is already part of W10 O/S.

It seems from my efforts to use the cmd to check things it is not......thus, I need to install Accesschk ?

If so, I assume thru Microsoft Technet ? https://technet.microsoft.com/en-us/sysinternals/accesschk.aspx

Not sure if I read the links that explain I would truly understand....thus hoping with this lengthy thread things are fairly solid on what needs to be inputed.  Reading thru remaker post he had no S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)........

Just like you said.  I had paused at first since I didn't have a "S:" section.  When I read up on SDDL at https://msdn.microsoft.com/en-us/library/windows/desktop/aa379570%28v=vs.85%29.aspx

I learned that you needed the O: G: D: and S: sections, in order.  I assumed taht if the S: section was missing from my original security descriptor, I assumed I could just add the CryptSvc declaration at the end.

It would be nice if Microsoft released a FixIt for this.  Seems like a lot of people have it, and it is some delicate surgery to fix it.

I sure 2nd he comment on Microsoft......would be VERY nice to have a FIXIT on this.

I also found several Windows 10 posts that vary slightly from W7/8.1 but align exactly to what I got from my sdshow.

I will read thru more carefully but could I trouble you to review the complete string as you see it...with adder ?

Here is my.........

C:>sc sdshow MSLLDP

D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)

Here is my thought............

C:>sc sdset MSLLDP D:(D;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;BG)(A;;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;SY)(A;;CCDCLCSWRPDTLOCRSDRCWDWO;;;BA)(A;;CCLCSWRPWPDTLOCRRC;;;SO)(A;;LCRPWP;;;S-1-5-80-3141615172-2057878085-1754447212-2405740020-3916490453)(A;;CC;;;S-1-5-80-242729624-280608522-2219052887-3187409060-2225943459)

Comments ?

I would be more fearful of installing some uninterpretable string provided over the internet than installing the sysinternals package.  With the latter, you can actually see what you are doing with regard to the security settings.  Without it, you should go to the reference cited somewhere in this thread so you understand exactly what you are doing (what all those characters actually mean). 

Your MSLLDP string is the same as mine was before modification. 

Your MUP string is different, but seems to include the proper substring.

My best guess from what you write is that you should add the same string:

(A;;CCLCSWLOCRRC;;;SU)

to your MSLLDP string sdset argument as mentioned by others.   I would also suggest doing a full disk backup so that if your modifications make your system unusable, you will be able to recover.