KDSrootkey kdsconfiguration values

Question

In order to start using group managed service accounts I went to create the KDS key only to find it had already been created, so I wanted to investigate how it was configured. There seems to be very little published information on what the various KDS root key configuration options are. Get-kdsconfiguration returns info, but I'm having no luck in finding out what the acceptable options are, or what might be considered best practice. Example, my output is this:

AttributeOfWrongFormat :
KdfParameters : {0, 0, 0, 0...}
SecretAgreementParameters : {12, 2, 0, 0...}
IsValidFormat : True
SecretAgreementAlgorithm : DH
KdfAlgorithm : SP800_108_CTR_HMAC
SecretAgreementPublicKeyLength : 2048
SecretAgreementPrivateKeyLength : 512
VersionNumber : 1

I have no idea if the SecretAgreementAlgorithm being "DH" is OK or should be something else, and no idea what those values in the SecretAgreementParameters map to. If there is an article somewhere that details what the options are here that could be referenced that'd be much appreciated!

Answer 1

Hi,
I found an article for this, for your reference:
https://winprotocoldoc.blob.core.windows.net/productionwindowsarchives/MS-GKDI/%5BMS-GKDI%5D-170601.pdf
Hope it will be helpful.
This response contains a third-party link. We provide this link for easy reference. Microsoft cannot guarantee the validity of any information and content in this link.

Fan