Unknown msDS-KeyCredentialLink Active Directory attribute added to computer objects

Question

I was looking for some more information on this attribute msDS-KeyCredentialLink. It is being added to our AD computer objects, and from my research, it appears that it is either because of Windows Hello for Business or Credential Guard. 

I have tried completely disabling windows hello for business, but the attribute continues to show up after removed. It populates back on reboots.

It appears to be credential guard that is causing this attribute, as I have also tried disabling credential guard, and then the attribute no longer gets populated. However, I don't think I should keep credential guard disabled. Is the msds-keycredentiallink attribute required for credential guard?

p.s. this attribute appears to have only started getting added to our computer objects after they were upgraded from Windows 10 to Windows 11

Answer 1

Hello,

Thank you for posting question on Microsoft Windows forum!

Based on your query of the attribute msDS-KeyCredentialLink being added to your AD computer objects. This attribute is an Active Directory attribute that stores public cryptographic keys associated with user or computer objects. These keys are used for various modern authentication mechanisms, primarily Kerberos Public Key Cryptography for Initial Authentication (PKINIT).

The followings are plausible explanations to address your concerns.

1.How this attribute relates to Windows Hello for Business (WHfB):

• User objects: For user objects, msDS-KeyCredentialLink is indeed used by Windows Hello for Business (WHfB). When a user enrolls in WHfB, their public key is often synchronized from Azure AD (if you're in a hybrid environment) to their user object in on-premises Active Directory. This allows the user to authenticate to on-premises resources using their WHfB credentials (PIN or biometrics).
• Computer objects: While WHfB is primarily user-centric, the msDS-KeyCredentialLink on computer objects is typically not directly caused by standard WHfB deployments for user authentication.

2.How this attribute is tied to Credential Guard for computer authentication.

• Device Public Key Authentication: Windows, particularly Windows 10 and especially Windows 11, can use public/private key pairs for device authentication to Active Directory Domain Controllers (DCs running Windows Server 2016 or later). This is known as "Domain-joined Device Public Key Authentication."
• Credential Guard's Role: When Credential Guard is enabled, it creates and protects a public/private key pair specifically for the device. The public key from this pair is then written to the msDS-KeyCredentialLink attribute of the corresponding computer object in Active Directory. This allows the device to authenticate to the domain using this secure, hardware-protected key.
• Why Windows 11 and not Windows 10? While the capability existed in Windows 10, Windows 11 often has stricter security defaults and may more aggressively leverage these modern authentication methods, including device public key authentication protected by Credential Guard. This would explain why you are seeing it more consistently after the upgrade.

Regarding the question of Is the msds-keycredentiallink attribute required for credential guard?

• It would probably be YES, for the device to perform public key authentication to Active Directory using a key protected by Credential Guard, its public key must be present in the msDS-KeyCredentialLink attribute on its computer object in Active Directory.
• It is most likely a normal or expected behavior to see the msDS-KeyCredentialLink attribute appearing on your Windows 11 computer objects when enabling Credential Guard for enhanced security and authentication mechanisms. It allows your devices to authenticate to Active Directory using robust, hardware-protected public/private key pairs, which is a significant security improvement.

You can refer to the following articles for more information

• https://learn.microsoft.com/en-us/windows/security/identity-protection/credential-guard/
• https://learn.microsoft.com/en-us/windows-server/security/kerberos/domain-joined-device-public-key-authentication
• https://learn.microsoft.com/en-us/answers/questions/961420/msds-keycredentiallink-exported-back-to-ad
• https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/deploy/hybrid-cert-trust

Hope the above information is helpful!