2

I would like to simplify my life and distribute secrets (real secrets, like encryption private keys) to Active Directory domain member computers. Probably via Active Directory Group Policy, but will be happy with any working solution.

  1. Only a subset of domain member computers require this secret.
  2. All computers which receive the secret, will receive one and the same secret. Secret is not computer specific.
  3. I need to transfer secret as file, registry value, certificate with private key in store or anything similar to let application read it, developer is kind of cooperating, so I have some freedom.
  4. I need to make sure the secret can be accessed only by specific users or groups, i.e. have effective ACLs, during and after deployment. Which means copying file with the secret from network share which is accessible by any authenticated user will not qualify, even if file level permissions are applied after copying.
  5. Domain controller is Windows 2016, member computers are various.

Certificate store "LocalMachine\My" is actually a good place to store the secret, but I can find no documented way to manage it via group policy. All other stores do not let me store private keys or at least I did not find how to accomplish that. I have found a lot of documentation about distributing public keys and certificates, but nothing about distributing private keys.

Some specific filesystem directory on NTFS volume, protected by filesystem permissions, is also a good place to store the secret, but can find no documented way to securely copy files there. All manuals recommend granting read permission to "Authenticated Users" on source network share which is not acceptable in my case.

Is it possible to distribute secrets at all? If yes, how?

Improve this question

1 Answer 1

Reset to default
1

Maybe I missed something, but why secure source share could be a problem? Would below work?

  1. create a domain local group that contains the computers that need the file (or registry)
  2. create a GPO filtered by above group. Remove other read permissions on the GPO in Delegation tab
  3. Set proper permission on destination file
  4. set source network share readable only to the group created in step 1
Improve this answer
1
  • As I understand, the users will be able to access the same data in the share, right? Is it possible to restrict access to scripts only, but not to the users on these machines?
    – greatvovan
    Mar 9, 2022 at 20:45

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .