I have a .NET Windows Service that needs to store a secret on the machine and protect that secret from local system administrators. It is OK if domain admins have access.
This secret is not user entered. It is generated at installation time, and the installation can be automated.
My first thought was to use EFS. If I ran my Windows Service as a domain account and stored the secret in an EFS encrypted file, even local system administrators couldn't access the file unless they were also domain admins and utilized an EFS recovery certificate.
Is there a better option? Is there a way to do this without requiring the Windows Service run as a domain account?