Private key security in windows certificate store

Question

When I import a public/private pair into windows certificate store, Windows does not require any password of any kind to encrypt the keys.

From that I conclude that if it is a user's store, it uses the user's password (or probably the user's hashed password) to encrypt the private key, and, if it is the local machine store, it is probably some kind of hardware-based key to encrypt the private key.

Did I get it right???

And if I did, what is the point of non-exportable keys if I can decrypt the keys???

And last question - If I got it right up to here, what are the alternatives?

Answer 1

As "SLanks" link explains, the private keys are encrypted with the user's password or the machines's password (depends on the location of the keys in the store).

Therefore, anyone who can log to the machine can obtain to this user's keys and anyone who has access to the machine can obtain keys stored for the local machine.