Below is my solution to this for Windows Server 2003 and IIS 6 and .Net 3.5 and Visual Studio 2008. Since the encryption is machine-specific, it HAS to be run on the web server.
Encryption Command (change PROJECT_NAME to your web app folder name):
c:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis -pef "connectionStrings" "C:\inetpub\wwwroot\PROJECT_NAME"
The second command gives the ASPNET account access to the NetFrameworkConfigurationKey in machine.config.
c:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis -pa "NetFrameworkConfigurationKey" "ASPNET"
The third command gives the NT Authority\Network Service account access to the NetFrameworkConfigurationKey.
c:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_regiis -pa "NetFrameworkConfigurationKey" "NT Authority\Network Service"
I hope this helps someone.