windows-itpro-docs/windows/security/identity-protection/hello-for-business/hello-hybrid-cert-whfb-settings-ad.md

title, description, keywords, ms.prod, ms.mktglfcycl, ms.sitesec, ms.pagetype, localizationpriority, author, ms.author, ms.date

title	description	keywords	ms.prod	ms.mktglfcycl	ms.sitesec	ms.pagetype	localizationpriority	author	ms.author	ms.date
Configuring Hybrid Windows Hello for Business - Active Directory (AD)	Discussing the configuration of Active Directory (AD) in a Hybrid deployment of Windows Hello for Business	identity, PIN, biometric, Hello, passport, WHFB, ad	w10	deploy	library	security, mobile	high	mikestephens-MS	mstephen	10/23/2017

Configuring Windows Hello for Business: Active Directory

Applies to

• Windows 10

This guide only applies to Hybrid deployments for Windows 10, version 1703 or higher.

The key synchronization process for the hybrid deployment of Windows Hello for Business needs the Windows Server 2016 Active Directory schema.

Creating Security Groups

Windows Hello for Business uses several security groups to simplify the deployment and managment.

Important

If your environment has one or more Windows Server 2016 domain controllers in the domain to which you are deploying Windows Hello for Business, then skip the Create the KeyCredentials Admins Security Group. Domains that include Windows Server 2016 domain controllers use the KeyAdmins group, which is created during the installation of the first Windows Server 2016 domain controller.

Create the KeyCredential Admins Security Group

Azure Active Directory Connect synchronizes the public key on the user object created during provisioning. You assign write and read permission to this group to the Active Directory attribute to ensure the Azure AD Connect service can add and remove keys as part of its normal workflow.

Sign-in a domain controller or management workstation with Domain Admin equivalent credentials.

1. Open Active Directory Users and Computers.
2. Click View and click Advance Features.
3. Expand the domain node from the navigation pane.
4. Right-click the Users container. Click New. Click Group.
5. Type KeyCredential Admins in the Group Name text box.
6. Click OK.

Create the Windows Hello for Business Users Security Group

The Windows Hello for Business Users group is used to make it easy to deploy Windows Hello for Business in phases. You assign Group Policy and Certificate template permissions to this group to simplify the deployment by simply adding the users to the group. This provides users with the proper permissions to provision Windows Hello for Business and to enroll in the Windows Hello for Business authentication certificate.

Sign-in a domain controller or management workstation with Domain Admin equivalent credentials.

1. Open Active Directory Users and Computers.
2. Click View and click Advanced Features.
3. Expand the domain node from the navigation pane.
4. Right-click the Users container. Click New. Click Group.
5. Type Windows Hello for Business Users in the Group Name text box.
6. Click OK.

Section Review

[!div class="checklist"]

• Create the KeyCredential Admins Security group (optional)
• Create the Windows Hello for Business Users group

[!div class="step-by-step"] < Configure Windows Hello for Business Configure Azure AD Connect >

---

Follow the Windows Hello for Business hybrid certificate trust deployment guide

1. Overview
2. Prerequistes
3. New Installation Baseline
4. Configure Azure Device Registration
5. Configure Windows Hello for Business settings: Active Directory (You are here)
6. Sign-in and Provision