Abstract: Aspects of the subject matter described herein relate to disclosing recovery keys. In aspects, when a recovery key is disclosed, data is updated to indicate that the recovery key has been disclosed. A machine that has locked data may determine whether a recovery key for the locked data has been disclosed and whether a new key needs to be generated for the locked data. If a new key needs to be generated for the locked data, the machine may generate the new key and send it to a recovery store for storage. In addition, old keys that protect the locked data may be deleted after the new key has been generated and stored.

Abstract: Aspects of the subject matter described herein relate to disclosing recovery keys. In aspects, when a recovery key is disclosed, data is updated to indicate that the recovery key has been disclosed. A machine that has locked data may determine whether a recovery key for the locked data has been disclosed and whether a new key needs to be generated for the locked data. If a new key needs to be generated for the locked data, the machine may generate the new key and send it to a recovery store for storage. In addition, old keys that protect the locked data may be deleted after the new key has been generated and stored.

Abstract: Aspects of the subject matter described herein relate to disclosing recovery keys. In aspects, when a recovery key is disclosed, data is updated to indicate that the recovery key has been disclosed. A machine that has locked data may determine whether a recovery key for the locked data has been disclosed and whether a new key needs to be generated for the locked data. If a new key needs to be generated for the locked data, the machine may generate the new key and send it to a recovery store for storage. In addition, old keys that protect the locked data may be deleted after the new key has been generated and stored.

Abstract: Aspects of the subject matter described herein relate to recovering locked data. In aspects, stakeholders of locked volume(s) are identified. Security data of the volume(s) that can be used to unlock the volume(s) is collected from one or more computing devices hosting the volume(s). The security data and stakeholder data is stored on a recovery store. If a stakeholder needs to unlock a volume, the stakeholder may communicate with a recovery manager, provide certain data, and receive data that may be used to unlock the volume. Auditing may be performed for attempts to obtain the unlocking data from the recovery store.

Abstract: Aspects of the subject matter described herein relate to encryption lifecycle management. In aspects, an orchestrating agent is installed on a device upon which encryption management is desired. During the lifecycle of the device, the orchestrating agent facilitates performing actions to protect the data of the device. For example, at certain points during the actions, the orchestrating agent may deduce the presence of external entities needed to perform the actions and interact with those entities to protect the data. During its facilitating activities, the orchestrating agent may also escrow protector data to use to unlock the data for legitimate stakeholders of the data.

Abstract: Aspects of the subject matter described herein relate to encryption lifecycle management. In aspects, an orchestrating agent is installed on a device upon which encryption management is desired. During the lifecycle of the device, the orchestrating agent facilitates performing actions to protect the data of the device. For example, at certain points during the actions, the orchestrating agent may deduce the presence of external entities needed to perform the actions and interact with those entities to protect the data. During its facilitating activities, the orchestrating agent may also escrow protector data to use to unlock the data for legitimate stakeholders of the data.

Abstract: Aspects of the subject matter described herein relate to disclosing recovery keys. In aspects, when a recovery key is disclosed, data is updated to indicate that the recovery key has been disclosed. A machine that has locked data may determine whether a recovery key for the locked data has been disclosed and whether a new key needs to be generated for the locked data. If a new key needs to be generated for the locked data, the machine may generate the new key and send it to a recovery store for storage. In addition, old keys that protect the locked data may be deleted after the new key has been generated and stored.

Abstract: Aspects of the subject matter described herein relate to recovering locked data. In aspects, stakeholders of locked volume(s) are identified. Security data of the volume(s) that can be used to unlock the volume(s) is collected from one or more computing devices hosting the volume(s). The security data and stakeholder data is stored on a recovery store. If a stakeholder needs to unlock a volume, the stakeholder may communicate with a recovery manager, provide certain data, and receive data that may be used to unlock the volume. Auditing may be performed for attempts to obtain the unlocking data from the recovery store.

Abstract: Accessing a data set with secret and non-secret data. A method includes accessing a data set image. The data set image comprises secret data. The data set image is derived from an authorized data set associated with a master key that authorizes access to the secret data. The master key is not provided with the data set image. The method further comprises restoring the data set image to a computing system to create a degraded data set. Data in the degraded data set other than the secret data is accessed without restoring the master key.

Abstract: A system and method for identifying network endpoints that provide a service of interest orders endpoints according to their network proximity to a requesting client. The requesting client may then contact the closest available providing endpoint, thus increasing the efficiency of usage of network resources while decreasing latency and enhancing reliability. In an embodiment of the invention, when a connection to the nearest providing endpoint cannot be established, a mechanism for locating a next-closest alternative endpoint is provided.

Abstract: A system and method for identifying network endpoints that provide a service of interest orders endpoints according to their network proximity to a requesting client. The requesting client may then contact the closest available providing endpoint, thus increasing the efficiency of usage of network resources while decreasing latency and enhancing reliability. In an embodiment of the invention, when a connection to the nearest providing endpoint cannot be established, a mechanism for locating a next-closest alternative endpoint is provided.

Abstract: A system and method for identifying network endpoints that provide a service of interest orders endpoints according to their network proximity to a requesting client. The requesting client may then contact the closest available providing endpoint, thus increasing the efficiency of usage of network resources while decreasing latency and enhancing reliability. In an embodiment of the invention, when a connection to the nearest providing endpoint cannot be established, a mechanism for locating a next-closest alternative endpoint is provided.

Abstract: Accessing a data set with secret and non-secret data. A method includes accessing a data set image. The data set image comprises secret data. The data set image is derived from an authorized data set associated with a master key that authorizes access to the secret data. The master key is not provided with the data set image. The method further comprises restoring the data set image to a computing system to create a degraded data set. Data in the degraded data set other than the secret data is accessed without restoring the master key.

Abstract: Accessing a data set with secret and non-secret data. A method includes accessing a data set image. The data set image comprises secret data. The data set image is derived from an authorized data set associated with a master key that authorizes access to the secret data. The master key is not provided with the data set image. The method further comprises restoring the data set image to a computing system to create a degraded data set. Data in the degraded data set other than the secret data is accessed without restoring the master key.

Abstract: Described is a technology in a distributed configuration network management environment, in which action-style documents are used as guides in processing structured documents to perform management tasks. For example, the action-style documents may be used by a standard stylesheet processor to validate a constitutional document, and process input lines of that constitutional document into output lines of a document. When executed, the output lines perform a management task. In this manner, for example, policy statements of an administrator are transformed into a single type of self-contained document that is consistently interpreted, and thus consistently executed, regardless of its source or when it was authored.

Abstract: Described is a technology in a distributed configuration network management environment, in which action-style documents are used as guides in processing structured documents to perform management tasks. For example, the action-style documents may be used by a standard stylesheet processor to validate a constitutional document, and process input lines of that constitutional document into output lines of a document. When executed, the output lines perform a management task. In this manner, for example, policy statements of an administrator are transformed into a single type of self-contained document that is consistently interpreted, and thus consistently executed, regardless of its source or when it was authored.

Abstract: Described is a technology in a distributed configuration network management environment, in which constitutional (governing, authoritative) documents are used to perform management tasks. The constitutional documents are structured so as to be consistent, self-contained and independently validated, yet may be combined with other constitutional documents to perform a management task. A constitutional document includes a schematic language statement, data transformation statements, and rule statements. In usage, the structured document is distributed to an agent on a client machine, which processes the structured document by transforming data and applying rules, such as to enforce network policy on client machines.

Abstract: Registering a client with a distributed service. A method may be practiced, for example, in a network computing environment including a client at a local site and a number of distributed services at a number of remote sites. The method includes pinging one or more distributed services at one or more remote sites. A message is received from a distributed service from among the one or more distributed services. The message specifies an optimal remote site. The method further includes registering with a distributed service at the optimal remote site.

Abstract: Communicating with a distributed service in the network computing environment. A method for communicating with a distributed service includes referencing a configuration registry to determine resources and permissions in a potential distributed service entry. A potential distributed service entry identifies a distributed service corresponding to the potential distributed service entry that is authorized to exist by virtue of an entry in the configuration registry for the potential distributed service entry specifying that the distributed service may exist, whether or not the distributed service corresponding to the potential distributed service entry exists. The method further includes using the resource information, attempting to contact the distributed service corresponding to the potential distributed service entry. Permissions of the distributed service corresponding to the potential distributed service entry are verified to match permissions of the potential distributed service entry.

Abstract: A network computer maintains a directory of objects having multi-valued attributes. The attributes are comprised of individual linked values having conflict-resolution data that indicates a change to an object at an attribute-value level. A second network computer stores a replica of the directory in which a replica of the objects is maintained. The computers replicate the objects in the directories and update the individual linked values of the attributes. Replication conflicts are identified and resolved with the conflict-resolution data at the attribute-value level of the objects.