Encrypt Connections Strings While Also Making Them Editable (using Enterprise Library)?

we are using the Enterprise Library data access application block in our data layer for an application. We must be doing something wrong though because we cannot seem to get encryption and the ability to reconfigure connection strings working well. For example, when the application starts, it checks if the connection strings are "Protected", and if they are not, we encrypt them using the following function:

[Code]...

Then comes another issue. If a user installs an update for the application, the first time it runs, nothing can connect if the config file was previously encrypted. A restart of the application (second time running) will fix the issue. with all of the battles we are fighting here, I wanted to ask if we are doing this right? How should we be encrypting and allowing updates. If you need to see the exceptions thrown, I can provide those upon request (will need to change some code to get them again, but it is doable).