>... the app running on Windows 2000 Server created the encrypted string (into a file on the network) and client apps on XP are not able to decrypt the string.

Hi!

The default Crypto provider for Windows 2000 is Rsabase.dll and for Windows XP it is Rsaenh.dll. You can change the default provider in the _CryptAPI's cProviderName property to "Microsoft Base Cryptographic Provider v1.0" which is what the dsMS_DEF_PROV_A constant in the wincrypt.h include file points to.