title: key not valid for use in specified state
body: <p>we are using CNG for encrypting some of our sensitive data. As a standard, we implement the SQL Integrated Security instead of using a SQL user with DB permissions. To implement this, we define the application Pool Identity as the same Active Directory identity which is given appropriate DB permission. </p>
  
  <p>Now, the problem is when my AppPool runs under Local System i can create &amp; retrieve keys from CNG Key Store however, the moment i change that identity to active directory user, i start getting "Key not valid for use in specified state" when i am trying retrieve the keys from CNG Store. Here are some of our observations:</p>
  
  <ul>
  <li><p>To implement CNG at User level, we need to be able to create User Level CNG keys instead of Machine keys. we have done that and the User level keys is getting created successfully, we can see it in UserProfile - C:\Users\ADusername\AppData\Roaming\Microsoft\Crypto\Keys</p>
  
  <ul>
  <li>We have set the "LoadUserProfile=True" in Pool Settings. </li>
  <li>We have given read/modify permission for AD user to %windows%\Microsoft.Net\Framework\Asp.Net Temp files as well</li>
  </ul></li>
  </ul>
  
  <p>we still continue to get this error. Any help would be highly appreciated.</p>