I would like to simplify my life and distribute secrets (real secrets, like encryption private keys) to Active Directory domain member computers. Probably via Active Directory Group Policy, but will be happy with any working solution.
- Only a subset of domain member computers require this secret.
- All computers which receive the secret, will receive one and the same secret. Secret is not computer specific.
- I need to transfer secret as file, registry value, certificate with private key in store or anything similar to let application read it, developer is kind of cooperating, so I have some freedom.
- I need to make sure the secret can be accessed only by specific users or groups, i.e. have effective ACLs, during and after deployment. Which means copying file with the secret from network share which is accessible by any authenticated user will not qualify, even if file level permissions are applied after copying.
- Domain controller is Windows 2016, member computers are various.
Certificate store "LocalMachine\My" is actually a good place to store the secret, but I can find no documented way to manage it via group policy. All other stores do not let me store private keys or at least I did not find how to accomplish that. I have found a lot of documentation about distributing public keys and certificates, but nothing about distributing private keys.
Some specific filesystem directory on NTFS volume, protected by filesystem permissions, is also a good place to store the secret, but can find no documented way to securely copy files there. All manuals recommend granting read permission to "Authenticated Users" on source network share which is not acceptable in my case.
Is it possible to distribute secrets at all? If yes, how?