If you want to store and recover keys generated by the Microsoft CA, create one or more recovery agents as explained below.

To create a recovery agent

1. In the Microsoft CA server machine, run MMC.
2. Under the Certificate Authority node, right-click Certificate Template, and select Manage.
3. Right-click Key Recovery Agent and select Duplicate Template.
4. Configure the following settings in each tab of the Properties of the New Template dialog. 
   • General
   • Request Handling
   • Issuance Requirements
   • Security
5. Under the Certificate Authority node, right-click Certificate Template and select New > Certificate Template to issue.
6. Select the newly created template.
7. Create a user in Active Directory.
8. Under the Personal node, right-click Certificates and select Tasks > Advanced Operations > Enroll On Behalf Of
9. Follow the wizard instructions. When prompted, select the newly created user.
10. Right-click the issued certificate and select Export.
11. Follow the wizard instructions. In the Export Private Key dialog, select Yes, export the private key.

General

Click this tab and write a name for the new template in the Template display name field.

Request Handling

Click this tab and check the Allow private key to be exported box.

Issuance Requirements 

Click this tab and set the following values.

Security 

Click this tab and assign the following permissions to the Domain Admins user group.

For example: