Network Management

SolarWinds.BusinessLayerHost.exe Deleting Files from MachineKeys Folder

SolarWinds.BusinessLayerHost.exe’s routine deletion of temporary certificate files in the Windows MachineKeys folder can trigger security alerts—such as McAfee ePO Exploit Prevention or Windows Audit logs—flagging “Windows EFS abuse,” but this behavior is expected and not malicious.

First published date

1/29/2020 11:19 AM

Last published date

8/24/2025 3:46 PM

Overview

Customers may report security alerts from McAfee ePO Exploit Prevention or other security tools indicating that SolarWinds.BusinessLayerHost.exe is deleting files from the MachineKeys folder, triggering a "Registry violation detected: Windows EFS abuse" or similar alert. This behavior is part of normal SolarWinds certificate management operations and is not malicious. Such activity may also be visible in Windows Security Audit logs.

Symptoms

  • Security alerts or blocks triggered by SolarWinds.BusinessLayerHostx64.exe accessing or deleting files under:
    C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\
  • Alerts may appear as "Malware Behavior: Windows EFS abuse," "Registry violation detected," or similar in McAfee ePO or other endpoint protection tools.
  • Corresponding events may also be logged in Windows Security Audit logs under file or registry access events.
  • The process SolarWinds.BusinessLayerHostx64.exe is signed by "SOLARWINDS WORLDWIDE, LLC".

Product section

Orion Platform

Cause

This issue occurs because the SolarWinds BusinessLayer agent plugin generates and manages certificates for secure communication with agents. This includes creating and deleting temporary certificates in the Windows certificate store located at:
C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\
 
Security tools may flag this behavior as suspicious because it involves deleting files and modifying permissions in a sensitive system folder, triggering alerts such as "Windows EFS abuse."
 
This behavior is expected and legitimate within the SolarWinds workflow and does not indicate malware or compromise.

Resolution

To prevent false positives and allow normal SolarWinds BusinessLayer operations, create a policy exception or whitelist in your security tool with these criteria:
  • Process: SolarWinds.BusinessLayerHostx64.exe
  • Process MD5 Hash: [Use the specific hash from your environment]
  • Process Signer: SOLARWINDS WORLDWIDE, LLC
  • Target Path: C:\ProgramData\Microsoft\Crypto\RSA\MachineKeys\*
  • Access Type: Change Permissions, Delete
For Windows Audit logs, ensure auditing policies are configured to monitor but not block this expected behavior.