daGrind Technologically Unchallenged

DPAPI

I wrote this documentation and project years ago and found it while looking through some of my archives last night. It probably still has some millage left and might be found useful to someone setting up DPAPI. You can download the binaries or source code below.

Download Binaries | Source

DPAPI Setup

1. Create the directory C:\DPAPI and copy the contents from the DPAPI directory (found in DPAPIBinaries.zip) into the new directory.

2. Create a local Windows account that will be used to run the Enterprise Services Application and Windows Service with the username DPAPIAccount. Make sure to uncheck the User must change password at next logon check box and check the Password never expires check box. Use the Local Security Policy tool in the Administrative Tools programs group to give the account the Log on locally and Log on as a batch job privileges.

You must log off with your current account and login as the DPAPIAccount user to create the user profile. Once you have logged in as the DPAPIAccount user you can then log off and log back in as your normal account.

3. Open a command prompt and run the following command to register the serviced component.

regsvcs C:\DPAPI\DPAPIComp.dll

4. Open the Component Services management console and navigate to the Component Services->Computers->My Computer->COM+ Applications folder. Right-click on the DPAPI Helper Application application and select the Properties menu option.

6. Click on the Identity tab and select the This user radio button. Enter the MachineName\DPAPIAccount username and password and then click on the OK button.

7. Expand the DPAPI Helper Application->Roles folder. You will need to add the users to the Roles\Users nodes that will need access to encrypt and decrypt. All users that need access to encrypt and/or decrypt must also be added to the Marshaler\Users node.

Add the MachineName\ASPNET ("NETWORK SERVICE" in IIS 6.0) user to all three groups for this example since we will test encrypting and decrypting through an ASP.NET application.

8. Open a command prompt and run the following command to install the Windows service.

installutil C:\DPAPI\DPAPIService.exe

Enter the MachineName\DPAPIAccount ("NETWORK SERVICE" in IIS 6.0) username and password and click the "OK" button.

9. Open the Services management console and start the DPAPI Service service.

10. Open the IIS management console and add a new virtual directory named DPAPIWeb.

11. Copy the contents from the DPAPIWeb directory (found in DPAPIBinaries.zip) into the new virtual directory.

12. Open http://localhost/DPAPIWeb/WebForm1.aspx in a browser and test encrypting and decrypting. Obviously, you would want to make sure that this application was not accessible outside of the local server.