title: ASP.NET Encryption - aspnet_regiis - Farm
body: <p>We have website that uses "NT Authority\Network Service". </p>
  
  <pre><code>Response.Write(WindowsIdentity.GetCurrent().Name); 
  </code></pre>
  
  <p>We are currently using the following command to encrypt the config files.</p>
  
  <pre><code>aspnet_regiis -pc "NetFrameworkConfigurationKey"
  aspnet_regiis -pa "NetFrameworkConfigurationKey" "NT Authority\Network Service"
  aspnet_regiis.exe -pef "connectionStrings" "C:\WebAppLocation\Folder"
  </code></pre>
  
  <p>Note: We are not using "-exp". When we use "-exp" it is not creating RSA Key Container.</p>
  
  <p>AS you can see, we are using the default key- NetFrameworkConfigurationKey. Our website has a load balancer. Webserver1(W1) and WebServer2 (W2) are available.</p>
  
  <p>If I follow the above mentioned commands, we will be using separate keys on W1 and W2. However the website works with this approach. </p>
  
  <p><strong>Is this approach sufficient?
   Does it got any shortcomings or secuirty holes? 
  Will it fail in any scenario?</strong></p>
  
  <p>Note: Machine key is added in our web.config. It is same in both config. However, our configProtectedData is not in the Web.Config. Also,I think, NetFrameworkConfigurationKey will be different in both the servers.</p>
  
  <p>I have read the following msdn aricle for Encryption in Web Farm Scenarios. 
  <a href="http://msdn.microsoft.com/en-us/library/ff650304.aspx" rel="nofollow">http://msdn.microsoft.com/en-us/library/ff650304.aspx</a></p>