System Service: Allow Admins to Impersonate User for Recovery

Hi All,

I'm working with a suite which allows users to work with encrypted
data. The data is encrypted under a key which is encrypted with DPAPI
(ie, tied to a user's account). So the user calls CryptUnprotectData
to retrieve their bulk encryption key, and then performs bulk
encryption using that key.

The software needs to allow an administrator to recover the encrypted
data. I believe that means an administrator needs to be able to call
CryptUnprotectData under a user's context to recover the key.

Is there an API call which allows a System Service to impersonate a
user *without* the user's password? Or do I need to look to other
functions/methods for the recovery effort?

Thanks in advance,
Jeff
.

Relevant Pages

  • Re: cannot retrive documents
    ... Go to the security tab and click advanced. ... Take Ownership of a File or Folder in Windows XP ... To recover encrypted files you will need the original ... encryption certificate or a Recovery Agent from the installation under which ...
    (microsoft.public.windowsxp.general)
  • Re: Is encrypting twice much more secure?
    ... of beneficiaries will have the ability to recover this data. ... source code of the decryption program. ... like the encryption being cracked. ...
    (sci.crypt)
  • Re: Unable to Decrypt Encrypted files
    ... Since the original account information in unavailable, there is no way to recover any of your encryption certificates. ... keys his data is gone. ...
    (microsoft.public.windowsxp.security_admin)
  • Re: Error msg during logon
    ... you would need the encryption certificate to ... > my old account.is there anyway to recover those documents? ... >> Your user profile is corrupt, there is generally no recovery from this. ... >> Associate Expert - WindowsXP Expert Zone ...
    (microsoft.public.windowsxp.newusers)
  • Re: File Encryption
    ... If you did not back-up the encryption key or the Recovery Agent and ... > reinstall winXP. ... > preciously encrypted files to decrypt. ... > How do i decrypt the files and recover them. ...
    (microsoft.public.windowsxp.security_admin)