Patricio Treviño · 01 November, 2018 · 2 min read

Encrypt a configuration section in a configuration file hosted in IIS

Syntax

      
        aspnet_regiis -pe <section> -app <virtualPath> [-location <subPath>] -prov <provider> [-pkm]

view raw syntax.text hosted with ❤ by GitHub

Option	Description
section	The section of the web.config to be encrypted.
virtualPath	The IIS website that hosts the web.config.
location	The subpath inside the IIS website that hosts the web.config.
prov	The name of the provider to be used to encrypt (configProtectedData).
pkm	Encrypts the machine config instead of the local config.

Example

      
        # Given a configuration fle like
      
        # <configuration>
      
        #   <configProtectedData>
      
        #     <providers>
      
        #       <add name="MyProtectedConfigurationProvider" 
      
        #            type="System.Configuration.RsaProtectedConfigurationProvider, ..." 
      
        #            keyContainerName="MyKeyContainer" 
      
        #            useMachineContainer="true" />
      
        #     </providers>
      
        #   </configProtectedData>
      
        # </configuration>
      
        $ cd "$env.WINDIR/Microsoft.NET/Framework64/v4.0.30319"
      
        $ .\aspnet_regiis -pe connectionStrings -app "/Default Website" -prov MyProtectedConfigurationProvider
      
          Microsoft (R) ASP.NET RegIIS version 4.0.30319.18408
      
          Administration utility to install and uninstall ASP.NET on the local machine.
      
          Copyright (C) Microsoft Corporation.  All rights reserved.
      
          Decrypting configuration sections...
      
          Succeeded!

view raw example.ps1 hosted with ❤ by GitHub

References

How to: Decrypt a web.config

	# Given a configuration fle like
	# <configuration>
	# <configProtectedData>
	# <providers>
	# <add name="MyProtectedConfigurationProvider"
	# type="System.Configuration.RsaProtectedConfigurationProvider, ..."
	# keyContainerName="MyKeyContainer"
	# useMachineContainer="true" />
	# </providers>
	# </configProtectedData>
	# </configuration>

	$ cd "$env.WINDIR/Microsoft.NET/Framework64/v4.0.30319"
	$ .\aspnet_regiis -pe connectionStrings -app "/Default Website" -prov MyProtectedConfigurationProvider
	Microsoft (R) ASP.NET RegIIS version 4.0.30319.18408
	Administration utility to install and uninstall ASP.NET on the local machine.
	Copyright (C) Microsoft Corporation. All rights reserved.
	Decrypting configuration sections...
	Succeeded!