If you're talking about key backup Microsoft handles that in Active Directory environments by storing a recovery key in the Directory protected by an ACL that l

If you're talking about key backup Microsoft handles that in Active Directory environments by storing a recovery key in the Directory protected by an ACL that limits access. It would be really nice (If anybody from MSFT is reading this!) if they encrypted that key w/ a public key. At this point at least, they just store it there in plaintext.