A computer implemented method, comprising: identifying a command for execution during a session with an Operating System, OS (step 210); retrieving an executable for an OS command launcher from a location that is based at least in part on the session (step 220), wherein retrieving includes decrypting a stored encrypted key with an OS-provided Key Encryption Key obtaining a key (step 221), and decrypting stored encrypted data with the key obtaining credentials associated with the session and a path to the location (step 221); validating the executable before processing the executable to launch the command for execution within the OS (step 230); wherein validating includes authenticating the credentials ensuring that the credentials were processed when the session was initiated within the OS (step 231) and wherein authenticating includes hashing the executable retrieved from the location over the path with the key obtaining a hash value and ensuring that the hash value is equal to a stored hash value (step 232); and generating a new hash value with a new randomly generated key for the executable; producing new encrypted data for the credentials and the path using the new randomly generated key, producing a new encrypted key for the newly generated key using the KEK, and storing the new hash value, the new encrypted data, and the new encrypted key for a subsequent iteration of the method with a second command that is presented for executing within the session (step 233); hashing the executable with a randomly generated key producing a hash value (step 240); encrypting credentials associated with the session and a path to the location with the randomly generated key producing first encrypted data (step 240); encrypting the randomly generated key with an OS-provided Key Encryption Key producing second encrypted data (step 240); and storing the hash value, the first encrypted data, and the second encrypted data (step 240). identifying a command for execution during a session with an Operating System, OS (step 210); retrieving an executable for an OS command launcher from a location that is based at least in part on the session (step 220), wherein retrieving includes decrypting a stored encrypted key with an OS-provided Key Encryption Key obtaining a key (step 221), and decrypting stored encrypted data with the key obtaining credentials associated with the session and a path to the location (step 221); validating the executable before processing the executable to launch the command for execution within the OS (step 230); wherein validating includes authenticating the credentials ensuring that the credentials were processed when the session was initiated within the OS (step 231) and wherein authenticating includes hashing the executable retrieved from the location over the path with the key obtaining a hash value and ensuring that the hash value is equal to a stored hash value (step 232); and generating a new hash value with a new randomly generated key for the executable; producing new encrypted data for the credentials and the path using the new randomly generated key, producing a new encrypted key for the newly generated key using the KEK, and storing the new hash value, the new encrypted data, and the new encrypted key for a subsequent iteration of the method with a second command that is presented for executing within the session (step 233); hashing the executable with a randomly generated key producing a hash value (step 240); encrypting credentials associated with the session and a path to the location with the randomly generated key producing first encrypted data (step 240); encrypting the randomly generated key with an OS-provided Key Encryption Key producing second encrypted data (step 240); and storing the hash value, the first encrypted data, and the second encrypted data (step 240).