DataProtectionServices should use keys stored in HKLM auto-gen registry when running on IIS without user profile.