Fixing corrupted encryption key store on Windows 10/11

When this hits

You're working on a Windows 10 22H2 or Windows 11 23H2 machine and suddenly apps that rely on encryption start failing. Chrome can't save passwords. Outlook won't open your OST file. Windows Hello asks you to set up again. The Event Viewer shows error IDs 1003 or 1008 from source 'Microsoft-Windows-CAPI2' with text like 'CryptAcquireContext failed' or 'Keyset does not exist'.

The trigger is almost always a cumulative update that didn't finish cleanly, or a disk write error during a power loss that killed the machine-side private key store. I've seen it happen after a forced Windows Update reboot cut power mid-optimization. It's not a virus—it's file corruption in a low-level system directory.

Root cause

Windows stores encryption keys—used by DPAPI (Data Protection API), BitLocker, and certificate services—in a folder called %APPDATA%\Microsoft\Crypto\RSA for user keys and %ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys for machine-level keys. Each key is a file with a GUID-style name. When a system update or crash corrupts one of these files, any app that tries to use that key gets a 'keyset does not exist' error even though the file is actually there but unreadable.

What's actually happening here is that the cryptographic service provider (CSP) tries to read the key file, fails CRC validation, reports it missing, and then the app falls over. The fix isn't just deleting the bad file—that can break things worse because other keys may chain to it. You need to rebuild the store cleanly.

The fix

Skip reinstalling Windows. Go through these steps in order. If step 3 works, stop—you're done.

1. Back up your user key store
   Open File Explorer, paste %APPDATA%\Microsoft\Crypto into the address bar, and copy the entire RSA folder to a safe location. This lets you roll back if something goes sideways.
2. Run the System File Checker
   Open an admin Command Prompt (Win+X > Terminal (Admin)). Run sfc /scannow. Let it finish—this fixes system files that might be corrupt. Reboot even if it says nothing found.
3. Check for corrupted machine keys
   In the same admin terminal, run certutil -store my. Look for any certificate with a status of 'Keyset does not exist'. If none appear, skip to step 4. If one does, open %ALLUSERSPROFILE%\Microsoft\Crypto\RSA\MachineKeys and sort by date modified. The newest file matching the certificate's thumbprint is the bad one. Delete it. That forces Windows to re-create the key pair on next app access. This is safe because the certificate itself is still in the store—only the underlying private key gets regenerated.
4. Rebuild the user DPAPI store
   Close all open apps. Press Win+R, type services.msc, and stop the 'Cryptographic Services' service (CryptSvc). Now delete the contents of %APPDATA%\Microsoft\Crypto\RSA—not the folder itself, just its files. Restart the service. Windows regenerates these key files the next time any app calls DPAPI. Your passwords and certificates tied to those keys will need re-entry, but your data stays intact.
5. Repair the TPM (if used)
   If you use BitLocker or Windows Hello, open an admin PowerShell and run Clear-Tpm -AllowClear. This resets the TPM to factory state. Reboot, then go through Windows Hello setup again. BitLocker will ask for your recovery key—have it ready. On the next boot, TPM re-provisions cleanly.

After step 4, test the failing app. Chrome works, Outlook opens, Event Viewer errors stop.

If it still fails

You've got a deeper problem. Check these three things:

• Disk errors — Run chkdsk c: /f /r from an admin prompt. A failing disk keeps re-corrupting the key store. I've seen this on old HDDs with bad sectors. Replace the drive if errors stay after a chkdsk pass.
• Antivirus interference — Some security suites (looking at you, McAfee) lock the key store files. Temporarily disable real-time protection, then retry step 4. If that fixes it, add an exclusion for %APPDATA%\Microsoft\Crypto in your AV settings.
• Corrupt user profile — Create a new local user account and test the app there. If it works, your old profile's registry hive (NTUSER.DAT) is damaged. Migrate your data to the new profile. That's a pain, but it's rarer than the other causes.

The reason step 3 works is that deleting a single machine key file removes the corrupted entry while keeping the certificate metadata intact. Windows sees the missing key on next demand, calls into the CSP, and rebuilds it from scratch. No reinstall needed, no data lost.