Do not allow the private key(s) to be extractable
Computer Configuration > Policies > Centrify Settings > Mac OS X Settings > Security & Privacy > Public Key Policies > Do not allow private key(s) to be extractable
Enabling this policy prevents exporting the auto-enrollment private key(s).
Note: This setting only applies to a new auto-enrollment private key. It does not change the auto-enrolled private key(s) that are already in the keychain.