Problem: I have a windows service running under the local system account. I have a blob of data that I want to store securely and persistently between reboots. I have decided to store it as a file( as opposed to a binary blob key in the windows registry?). Since I'm running in a service I cannot have user interaction to get a password and use something like pbkdf2 etc to derive an encryption key to encrypt the file which contains the data blob. I'm looking for the best possible way to store the file securely on the windows file system. Below is the set of assumptions that I have made on what I trust and what attack scenarios are important to be followed by a proposed implementation. It'll be great if anybody can poke holes and also suggest better alternatives.
Assumptions and attack scenarios: I assume the operating system ie windows to be trusted and secure. If a security flaw is found in windows and my secret/encrypted file is compromised, it is okay. If the admin account is compromised and the file is deleted, it's okay. However, other users without access to say windows\system32(which seems like one of the most locked down directories) should not be able to access or delete this file through code or UI. It would be preferable if the file can be stored in a location where even admin users don't have access but my service does but I don't know of such a location. Dumb admin users who delete system files are not a threat/problem. The main goal is to protect against trivial deletion and modification of the file through UI and user code.
Implementation: I plan to use windows DPAPI without using user credentials(because I can't in the local system account service) to lock it to a particular user. I plan to encrypt the file to the local system and also provide some entropy/service specific key to encrypt and decrypt the file. The app-specific entropy will be a guide plus some information that is hardware specific(such as firmware rev or other data that can be read off hard-coded hardware registers) and only my service have access to and no other software can access this information. I realize if the firmware rev is updated or hardware changed, decryption will not work but this should be a rare situation. An attacker can dump/analyze my service binary and figure out the guide but hopefully, the hardware specific information should be difficult to get to. If I do this, and place the encrypted blob In a file in windows\system32, only admin/higher privilege users allowed access to this through file system API/UI will be able to decrypt it using DPAPI(if they get the guide and hardware specific info that nobody should be able to get to) or read/write delete the file through code or UI. Storing the blob unencrypted in the registry should nearly offer the same protection against most attacks except that an admin user can modify the binary data/blob and can cause bad software behavior. DPAPI offers integrity protection so I chose this over simply writing to a secure-ish location in the registry which nobody other than admin users can get to.
Does this look okay or are there better ways to achieve this? Any other security holes to watch out for or think about? This is a fairly simple issue so I'd like to implement the simplest solution.