I'm reading this documentation page about Modifying encrypted data. It says "To use the Access Management tool, you must be logged in as a properly authorized user." Further down, the described procedure says that you should either sign in as the user who originally ran the "start" script, or that you should sign in as the Windows Local System account.
Signing in as Local System doesn't strike me as practical. Is there an alternative technique available for use when running the services as Windows Services?
Having to log in as the user who ran the original installation is also less than ideal. With the configuration encryption in previous versions, we had similar issues, where the necessary key pair would be associated with a Windows account, but we were able to safeguard the key pairs by exporting them with aspnet_regiis. Is there a similar technique we might use in combination with
dotnet AppSettingsProtector.dll protect? Does this differ between Windows and Linux?