Q:

Silently importing PFX with strong key protection

I've got a certificate that I need to import on a number of systems, and I'm trying to set high strong key protection on that certificate, so that when it is used, the user has to enter a password.  I've found this certutil command:
certutil -f -user -p <certPwd> -importPFX .\<certName>.pfx Protect

There are two problems with this:

This sets the security to medium by default.  I can select High, and then it asks me to set a password, but I need it to be High by default
I need to pass the password via a command, with no UI displayed on the screen.  I don't want to have to manually set the password on every system, so am looking to do this via GPO or SCCM, although I'm open to other methods if needed.

I cannot find any way to set this strictly via command line, either through certutil or PowerShell.  I'm hoping someone might know more than I?  Can anyone assist?

A:

The purpose of strong key protection is to require user interaction so the user explicitly confirms key operations and no operations can be scripted/automated without user explicit approval. Here is the point. Thus, strong key protection and key access automation are mutually exclusive.

