Meziantou.FrameworkLsaPrivateData Class
- Supported on windows5.1.2600
Provides methods to interact with Local Security Authority (LSA) private data storage on Windows. LSA private data storage keeps values encrypted on disk under a DACL that allows only the creator and administrators to read them.
[SupportedOSPlatform("windows5.1.2600")]
public static class LsaPrivateDataRemarks
Microsoft recommends CryptProtectData and CryptUnprotectData over the LSA private data functions unless you specifically need to manipulate LSA secrets. The stored data is not absolutely protected.
The key name decides how far the secret reaches. A name starting with L$ creates a local object that cannot be accessed remotely, G$ a global object, and M$ a machine object that only the operating system can read back. A name with none of those prefixes creates an object that can be accessed remotely, so prefer an L$ prefix unless you need otherwise.
Example
Store and retrieve a secret value:
// Store a secret value (requires administrator privileges)
LsaPrivateData.SetValue("L$MySecretKey", "MySecretValue");
// Retrieve the value
string? value = LsaPrivateData.GetValue("L$MySecretKey");
Assert.Equal("MySecretValue", value);
// Remove the value (requires administrator privileges)
LsaPrivateData.RemoveValue("L$MySecretKey");Methods
| Name | Description |
|---|---|
| GetValue(string) | Retrieves a value from LSA private data storage. |
| RemoveValue(string) | Removes a value from LSA private data storage. Requires administrator privileges. |
| SetValue(string, string?) | Stores a value in LSA private data storage. Requires administrator privileges. |
GetValue(string)
LsaPrivateData.csRemoveValue(string)
LsaPrivateData.csSetValue(string, string?)
LsaPrivateData.csStores a value in LSA private data storage. Requires administrator privileges.