5.8

Change Permissions On Machine Certificate Keys
If you plan to use certificate keys generated by Installation Manager for HTTP communication between
the VCM Collector and the VCM Agents on managed machines, you must review your security policy.
You can change the permissions on the certificate key to allow the Administrators group to have full
control after you install VCM.
The Foundation Checker system check reports a warning message about the security policy used to create
new objects. The security policy sets the permission on new files to the Administrators group instead of
the creator of the object. The system check does not stop the installation process, but instead creates a
certificate and associated cryptographic keys.
If the security policy is not set appropriately when Installation Manager generates the certificate, the
certificate private key is not accessible to other members of the Administrators group and causes HTTP
communication with the Agents to fail.
The TLS certificate private key to be generated on the Windows machine must have permissions that
include the Administrators group as the owner or as having full control. You cannot resolve this warning
before you install VCM. If an error occurs, after installation, you must either change the group policy so
that new files are assigned to the Administrators group and run Installation Manager again, or add the
Administrators group with full control to the generated certificate key file in the Machine Keys folder.
Prerequisites
n Install VCM. See "Installing VCM" on page125.
Procedure
1. Browse to C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys.
This path is the default location for your private keys. This path might differ depending on your
organizational policies.
2. Expand the MachineKeys folder.
The key that matches the date and time when you generated the certificate during installation is most
likely the correct key. Because another reliable method does not exist to identify the key, use the date
and time.
3. Right-click the key file and click Properties.
4. In the Machine Key Properties dialog box, click the Security tab.
5. Click Continue to continue as an administrative user.
6. In Advanced Security Settings, select the account and click OK to take ownership of an account.
7. In the Permissions dialog box, click Administrators and confirm whether the Administrators group
has Full Control.
8. If the Administrators group does not have full control, click Add to add the group.
9. In the Select Users, Computers, Service Accounts, or Groups dialog box, type the name of the
Administrators group and click Check Names.
When the name is validated, click OK to return to the Permissions dialog box and add the
Administrators group to the Group or user names area.
10. In the Allow column, click Full Control.
11. Click OK and click OK again to save changes.
vRealize Configuration Manager Advanced Installation Guide
128
VMware, Inc.