How does Windows or IIS protect a certificate or it's private key?

my question of basic nature. , think boils down constraining file system , registry access. have confirmed has windows experience.

in general given ssl certificate , private key stored in certificate store. operating system or application webserver access there 3 options:

1. no password protection. access certificate store can access certificates , keys holds;
   
2. password protected. on starting server or service needs manually enter password;
   
3. password protected. password stored somewhere on machine. on starting stored password used. 

 

i not familiar how windows or iis handle this, expect works somehow similar under hood. problem don't know sure. how iis able use certificate in windows if no 1 enters it's password? or password stored in registry?

familiar using option 3 in non windows environments. there password storage protected using file access controls.

wonder if windows more secure. or not know , in case it's security obscurity.

question: knows how windows/iis handles explain options 2 , 3? , if there other magic going on?

btw. solutions hsm or nifty remote service-monitor automatically logs on , enters password i'm not interested in @ moment. how windows handles normally.

 using google have found various answers explain things in general. return 3 options mentioned , tell me have faith. is, that's interpretation.

following 2 sites seem explain more windows specific. cannot deduct if indeed confirm option 3 in windows stores password located somewhere in registry.

• [codinghorror] keeping private keys private
  
• [rootsecurity] how export “non-exportable” certificates microsoft certificate store
  

access certificates , key material in windows, when using software protection (that no external hardware device) controlled combination of acl , data protection api.

iis, default, runs in security context of local system account definition not have password.

information on local system account , dpapi can found on both technet , msdn.

Windows Server  >  Security