Key Management Service is an optional Exchange 2000 component that you can install on a designated server in an administrative group. Key Management Service provides centralised administration for private keys, an archive of private keys, and also maintains every user's private encryption key in an encrypted database. These keys are used to encrypt e-mail messages and sign messages with digital signatures. Exchange 2000 Advanced Security creates and manages the public key infrastructure (PKI) for your Exchange 2000 organisation.

The Exchange 2000 Advanced Security feature uses Key Management Service to provide added security for your messaging system. Exchange 2000 PKI secures message content through data encryption and digital signatures. PKI also sets up a centralised management system of keys and certificates for all enrolled users within your administrative groups.

The Exchange 2000 Advanced Security feature consists of two components: Encryption Configuration and Key Manager.
Together, Encryption Configuration and Key Manager provide secure messaging through cryptographic key pairs.

Key pairs consist of a public key and a private key. Advanced Security is a dual key pair system, so users are provided with separate key pairs for encryption and digital signatures. To successfully back up Key Management Service, you must also back up the Key Management Service database and the certification authority (CA).

To back up the Key Management Service database, select the Key Management Service option within Backup. Because the CA is a type of System State data, the CA is backed up as part of a Windows backup set.

The information in this article applies to:

• Microsoft Exchange Server 2003 Enterprise Edition
• Microsoft Exchange Server 2003 Standard Edition
• Microsoft Windows Small Business Server 2003, Premium Edition
• Microsoft Windows Small Business Server 2003, Standard Edition
• Microsoft Exchange 2000 Server