title: Storing private "octet string" in Active Directory; what is secure by default?
body: <p>I am essentially storing a private key (Hash) in any of the OctetString attributes within Active Directory.</p>
  
  <p>My question is, what attribute is secure by default and makes sense to keep private data there?  This value should be considered similar to a password, where even administrators shouldn't have access (if possible), just like the current AD Password.</p>
  
  <p>Here is a start of a list of attributes that are enabled by default on a Windows 2008R2 + Exchange 2010 domain.</p>
  
  <p><img src="https://i.stack.imgur.com/g3cgk.png" alt="alt text"></p>
  
  <p><strong>Update:</strong></p>
  
  <p>Does anyone know of an Octet String attribute that does not expose "read" permissions to all users in the domain by default?  I don't want to store my hash publicly and allow someone to build a rainbow table based on the hashes.</p>