Information on msDS-KeyCredentialLink

Question

Hello, I was looking for some more information on this attribute msDS-KeyCredentialLink. It is being added to our AD user objects, and it appears that it is because of Credential Guard. Is this attribute a public key? I am not able to find this information on any Microsoft article, so if you can confirm this, that would be great. Thanks

Answer 1

Hi SA,

Do any of these references help?

https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust "Windows Hello for Business is tied between a user and a device. Both the user and device need to be synchronized between Microsoft Entra ID and Active Directory. Device write-back is used to update the msDS-KeyCredentialLink attribute on the computer object."

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-ada2/45916e5b-d66f-444e-b1e5-5b0666ed4d66

https://learn.microsoft.com/en-us/openspecs/windows_protocols/ms-adts/f70afbcc-780e-4d91-850c-cfadce5bb15c

https://learn.microsoft.com/en-us/entra/identity/hybrid/connect/reference-connect-sync-attributes-synchronized "msDS-KeyCredentialLink X Once the user is enrolled in Windows Hello for Business."

HTH

Regards,