---

$cert = Get-ChildItem Cert:\LocalMachine\My |
    Where-Object { $_.Thumbprint -eq "5F70475129E66B7C4FAEDC00724E7ADF1EE16444" }

$rsa = [System.Security.Cryptography.X509Certificates.RSACertificateExtensions]::GetRSAPrivateKey($cert)

if ($rsa -is [System.Security.Cryptography.RSACng]) {
    $keyPath = "$env:ALLUSERSPROFILE\Microsoft\Crypto\Keys\$($rsa.Key.UniqueName)"
} else {
    $keyPath = "$env:ALLUSERSPROFILE\Microsoft\Crypto\RSA\MachineKeys\$($rsa.CspKeyContainerInfo.UniqueKeyContainerName)"
}

Write-Host "Key file: $keyPath"
Test-Path $keyPath        # должно быть True

icacls $keyPath /grant "*S-1-5-20:(R)"
Restart-Service TermService -Force