Microsoft Sharepoint Products and Technologies Resource Kit eBook

712 Part VIII: Securing SharePoint Products and Technologies
You cannot create the encryption key remotely. To re-generate the encryption
key, go to the computer running as the job server, log on as the single sign-on
administrator account, and do the following:
1. On the SharePoint Portal Server Central Administration for server_name page,
in the Component Configuration section, click Manage settings for single
sign-on.
Alternatively, click Start, point to All Programs, point to SharePoint
Portal Server, and then click SharePoint Portal Server Single Sign-On
Administration.
2. On the Manage Settings for Single Sign-On for server_name page, in the
Server Settings section, click Manage encryption key.
3. On the Manage Encryption Key page, in the Encryption Key Creation section,
click Create Encryption Key.
4. On the Create Encryption Key page, to re-encrypt the credentials for the single
sign-on database, select the Re-encrypt all credentials by using the new
encryption key check box, and then click OK.
Note If you do not re-encrypt the existing credentials with the new encryption
key, users must retype their credentials for individual application definitions,
and administrators for group application definitions must retype
group credentials.
Backing Up the Encryption Key
After creating the encryption key, you should back it up. You must back up the key
to a 3.5-inch floppy disk. You should lock up the backup disk for the encryption key
in a safe place.
Note Because the encryption key is the key that decrypts the encrypted
credentials stored in the single sign-on database, the backup copy of the
key should not be stored with the backup copy of the database. If a user
obtains a copy of both the database and the key, the credentials stored in
the database could be compromised.