The password store on Windows 2008 / Vista

I always recommend a profile management system for Citrix XenApp installations; the free Flex Profile Kit is a favourite, but I recently implemented AppSense Environment Manager (EM) for profile management on Windows 2008 Server and found that Internet Explorer passwords were not being saved. After some investigation I found that the password store is handled very differently in Windows 2008 Server and Vista.
In Windows 2008/Vista the password store in the user’s profile is not roamed, even though it is in the roaming folder… that makes lots of sense…
From what I can gather the Microsoft method is to use Certificate Services which is configured via GPO and saves credentials to the user’s AD object. See this article and this article.
From an AppSense EM perspective the “Manage Certificates” personalisation option saves IE passwords, so this is the easiest option.
A second method of saving IE passwords using AppSense or Flex Profiles is to save the Protect folder from the user’s profile at logoff and restore it at logon. I have tested this and it works perfectly.
The piece of data that needs to be saved from the user’s profile is the folder %userprofile%\AppData\Roaming\Microsoft\Protect