Do not allow the private key(s) to be extractable
User Configuration > Policies > Centrify Settings > Mac OS X Settings > Security & Privacy > Public Key Policies > Do not allow private key(s) to be extractable
Enabling this policy prevents exporting the auto-enrollment private key(s).
Note: This setting only applies to new auto-enrollment private key(s). It does not change auto-enrolled private keys that are already in the keychain.