Microsoft Sharepoint Products and Technologies Resource Kit eBook

714 Part VIII: Securing SharePoint Products and Technologies
6. Remove the 3.5-inch disk from the disk drive.
Note Restoring the encryption key and re-encrypting the single sign-on credentials
store with the restored key is a long-running process. It is recommended
that you restore the encryption key during non-peak periods.
Enabling Auditing for the Encryption Key
You should enable auditing for the encryption key. Then, if the key is read or written
to, there will be an audit trail in the security log in Microsoft Windows
Server 2003 Event Viewer.
To enable auditing for the encryption key, you need to modify the registry
using regedit and then enable auditing using Group Policy Object Editor.
1. To modify the registry, do the following:
a. On the taskbar, click Start, and then click Run.
b. Type regedit and then click OK.
c. In Registry Editor, navigate to HKEY_LOCAL_MACHINE\SOFTWARE
\Microsoft\ssosrv\Config.
d. Right-click Config, and then click Permissions.
e. In the Permissions for Config dialog box, click Advanced.
f. In the Advanced Security Settings for Config dialog box, click the
Auditing tab, and then click Add.
g. In the Select User, Computer, or Group dialog box, in the Enter the
object name to select box, type everyone.
h. Click OK.
i. In the Auditing Entry for Config dialog box, in the Failed column,
select the Full Control check box, and then click OK.
j. Click OK, and then click OK again to close all dialog boxes.
k. Close Registry Editor.
To enable auditing, do the following:
1. On the taskbar, click Start, and then click Run.
2. Type mmc and then click OK.