www.BlackViper.com: Windows 7 Services 411 - CNG Key Isolation

CNG Key Isolation

Default Description:

The CNG key isolation service is hosted in the LSA process. The service provides key process isolation to private keys and associated cryptographic operations as required by the Common Criteria. The service stores and uses long-lived keys in a secure process complying with Common Criteria requirements.

Additional Information:

This service is required for Wireless Networks as well as the following group of services:

• CNG Key Isolation
• Extensible Authentication Protocol
• Wired AutoConfig
• WLAN AutoConfig

WLAN AutoConfig, if set to Manual, will not start automatically if you use a hardware switch (such as those on laptops to turn on and off the wireless network card). If you require wireless connectivity on your computer, keep the listed services above on the default values as well as place WLAN AutoConfig into Automatic. If you do not have a wireless card installed on the system, or do not require authentication on your wired network card, the group of services can safely be disabled.

Additional Reading:

• CNG: http://msdn2.microsoft.com/en-us/library/bb204775(VS.85).aspx
• Common Criteria: http://en.wikipedia.org/wiki/Common_Criteria
• EAP: http://en.wikipedia.org/wiki/Extensible_Authentication_Protocol

Discussion Topic Link:

Windows 7 Services Forum

Defaults Startup Type:

Windows 7 Starter: Manual (Started)
Windows 7 Home Basic: Manual (Started)
Windows 7 Home Premium: Manual (Started)
Windows 7 Professional: Manual (Started)
Windows 7 Ultimate: Manual (Started)
Windows 7 Enterprise: Manual (Started)

Other Settings:

Safe Setting: Manual

Service Names:

Service Name (registry): KeyIso

Display Name: CNG Key Isolation

Default Path and Command Line Options:

C:\Windows\system32\lsass.exe

Log On As:

Account: Local System account

Dependencies:

What service CNG Key Isolation needs to function properly:

• Remote Procedure Call (RPC) (S, HB, HP, P, U, E)
  • DCOM Server Process Launcher (S, HB, HP, P, U, E)
  • RPC Endpoint mapper (S, HB, HP, P, U, E)

What other service require CNG Key Isolation to function properly:

• Extensible Authentication Protocol (S, HB, HP, P, U, E)
  • Wired AutoConfig (S, HB, HP, P, U, E)
  • WLAN AutoConfig (S, HB, HP, P, U, E)

Registry Settings (.reg):

Windows Registry Editor Version 5.00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\KeyIso]
"DisplayName"="@keyiso.dll,-100"
"ImagePath"=hex(2):25,00,53,00,79,00,73,00,74,00,65,00,6d,00,52,00,6f,00,6f,00,\
74,00,25,00,5c,00,73,00,79,00,73,00,74,00,65,00,6d,00,33,00,32,00,5c,00,6c,\
00,73,00,61,00,73,00,73,00,2e,00,65,00,78,00,65,00,00,00
"Description"="@keyiso.dll,-101"
"ObjectName"="LocalSystem"
"ErrorControl"=dword:00000001
"Start"=dword:00000003
"Type"=dword:00000020
"DependOnService"=hex(7):52,00,70,00,63,00,53,00,73,00,00,00,00,00

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\KeyIso\Security]
"Security"=hex:01,00,14,80,b4,00,00,00,c0,00,00,00,14,00,00,00,30,00,00,00,02,\
00,1c,00,01,00,00,00,02,80,14,00,ff,01,0f,00,01,01,00,00,00,00,00,01,00,00,\
00,00,02,00,84,00,06,00,00,00,00,00,14,00,fd,01,02,00,01,01,00,00,00,00,00,\
05,12,00,00,00,00,00,18,00,ff,01,0f,00,01,02,00,00,00,00,00,05,20,00,00,00,\
20,02,00,00,00,00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,04,00,00,00,00,\
00,14,00,9d,01,02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,8d,01,\
02,00,01,01,00,00,00,00,00,05,06,00,00,00,00,00,14,00,00,01,00,00,01,01,00,\
00,00,00,00,05,0b,00,00,00,01,01,00,00,00,00,00,05,12,00,00,00,01,01,00,00,\
00,00,00,05,12,00,00,00