LogonSessionId account assigned Read access in new certificates?

Question

I have a question that (hopefully) someone can shed some light on. I was writing a Powershell script that would import a certificate to the Local Machine store, and assign the Everyone group Read permissions to the private key's on the certificate.

Now, I do have a working script that does accomplish this, but I've noticed that I have an account called "LogonSessionId_0_some-random-number" assigned Read permissions to the ACL on the private keys as shown in the following image:

At first I thought this was my script maybe doing this, but when I manually import the certificate I get the same result.

Has anyone seen this before or know why this is happening? What exactly is this account and why are permissions being assigned? I've tried to search for some answers on this but have come up short.

Not sure if it helps, but this is the portion of my code that imports the certificate and assigns the permissions:

    $sslCert = gci Cert:\LocalMachine\My | WHERE {$_.Subject -match $getCerts}
    $sslCertPrivKey = $sslCert.PrivateKey
    $privKeyCertFile = Get-Item -path "$ENV:ProgramData\Microsoft\Crypto\RSA\MachineKeys\*"  | WHERE {$_.Name -eq $sslCertPrivKey.CspKeyContainerInfo.UniqueKeyContainerName}
    $privKeyAcl = (Get-Item -Path $privKeyCertFile.FullName).GetAccessControl("Access")
    $permission = "Everyone","Read","Allow"
    $accessRule = New-Object System.Security.AccessControl.FileSystemAccessRule $permission
    $privKeyAcl.AddAccessRule($accessRule)
    Set-Acl $privKeyCertFile.FullName $privKeyAcl

I'm using Windows 10 Pro.

Any help/insight is greatly appreciated!

Answer 1

It's because you have different scopes. When you add something at the machine level, by default it gives all users read permissions. Everyone with access to that computer will be able to see the certificate. You don't need to explicitly give users read access for a machine level certificate. It's like when you install some programs they ask "Install for all users?" If you say yes, it installs at the machine level and everyone can use it, otherwise it will install for just you and logging in with a different user means they won't have access.

Comment out the user-specific part of your script to test what I'm saying, you'll notice all users are given read-only and things will work as expected.