WindowsAccessControlCertificatePrivateKeySecurityDescriptor

Parameters

Parameter	Attribute	DataType	Description	Allowed Values
KeyName	Key	System.String	The exact persisted CNG key name whose DACL is managed.
KeyScope	Key	System.String	Selects the machine or current-user key store.	Machine, User
ProviderName	Key	System.String	The exact expected CNG provider. This increment accepts only Microsoft Software Key Storage Provider.
Sections	Key	WindowsSecurityDescriptorSection	The security descriptor sections this resource owns. Only the access section is supported for a private key.	Owner, Group, Access, Audit, All
Sddl	Required	System.String	The desired DACL in SDDL form. Capture it from Get-CertificatePrivateKeySecurityDescriptor.
Reasons	Read	WindowsAccessControlDscReason[]	Returns why the resource is not in the desired state. Not configurable.

Description

Compares the private key's access control list against the desired SDDL and rewrites it. The key is addressed by provider, key name, and scope rather than by certificate thumbprint, because a renewal that reuses the key changes the thumbprint. Private key material is never exported or serialized.