Content Manager configuration snap-in “Could not r

I am on a Tridion 2011 SP1 CM server and I’m trying to start the SDL Tridion Content Manager configuration MMC snap-in.

I get the following error:

Could not read configuration item. Modification of this item is not available on this machine. Account has no permission to access the protected configuration section 'tridion.security'. Contact your system administrator.

My user is of course part of the local admins.

What is going on? how to fix it?

The Content Manager uses a .NET encryption key to ensure the encryption of sensitive configuration data such as passwords. By default nothing is encrypted. The following user accounts automatically have access to this encryption key:

Any Content Manager system account (including the Content Manager user account and impersonation user accounts created during installation)
The user account of the user who originally ran the installer

The use of the configuration encryption functionality is completely transparent, so long as the following is true:

The user account that runs the SDL Tridion MMC Snap-in configuration tool is the same user account that originally ran the installer.
The user executing the various SDL Tridion Windows services is not changed from its default value.

If you want to run the Snap-in and/or Windows services as another user than specified, you must grant that new user access to the encryption key. To grant this access, log on as the user account of the user who originally ran the installer, or as another, similarly authorized user with access to the encryption key, and do the following:

Open a Windows command prompt.
Go to a directory on your machine on which a version of the .NET Framework is installed (a subdirectory of C:\Windows\Microsoft.NET\Framework\ or C:\Windows\Microsoft.NET\Framework64\).
Enter the following command:

aspnet_regiis -pa "TridionRsaKeyContainer" "<domain>\<account>" where <domain> is the domain of this user and <account> is the username of the user.