title: Using DPAPI / ProtectedData in a web farm environment with the User Store
body: <p>I was wondering if anyone had successfully used DPAPI with a user store in a web farm enviroment?</p>
  
  <p>Because our application is a recently converted from 1.1 to 2.0 ASP.NET app, we're using a custom wrapper which directly calls the <code>CryptUnprotect</code> methods. But this should be the same as the <code>ProtectedData</code> method available in the 2.0 framework.</p>
  
  <p>Because we are operating in a web farm environment, we can't guarantee that the machine that did the encryption is going to be the one decrypting it. (Also because machine failures shouldn't destroy our encrypted data).</p>
  
  <p>So what we have is a serviced component that runs in a service under a particular user account on each one of our web boxes. This user is a set up to have a roaming profile, as per the recomendation.</p>
  
  <p>The problem we have is that info encrypted on one machine can not be decrypted on another, this fails with the win32 error: </p>
  
  <blockquote>
    <p>'Key not valid for use in specified state'.</p>
  </blockquote>
  
  <p>I suspect that this is because I've made a mistake by having the encryption service running as the user on multiple machines, hence keeping the user logged in on more than one machine at the same time. </p>
  
  <p>If this is the problem, how are other using DPAPI with the User Store in a web farm environment?</p>