Skip to main content
The Online Responder service runs as the Network Service account, so the Futurex CNG provider’s log file must be placed in a directory that account can write to.
The log file must be stored in a location accessible by the Network Service account, which is the account used by the Online Responder service. Using a path under C:\Users\ will cause log writes to fail silently when the Online Responder calls the Excrypt HSM.
1
Create the log directory and grant Network Service write access:
PowerShell
Verify the permissions were applied correctly:
PowerShell
Confirm that NT AUTHORITY\NETWORK SERVICE appears with FullControl in the output.
2
In the <CONFIG> section of the fxcng.cfg file, set the log file path to the new directory:
fxcng.cfg
For development testing, set <LOG-MODE> to DEBUG and <LOG-TRAFFIC> to YES. Once in production, set <LOG-MODE> to INFO and <LOG-TRAFFIC> to NO. Set <LOG-CONSOLE> to NO: the default fxcng.cfg sets it to YES, which prints the provider log into the output of certutil and certreq.
Now test the connection to the HSM as described in Verify the provider.