Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Are any applications (off the shelf, or internal) leveraging Active Directory's Confidential Attributes?

Would you store sensitive information here such as a private key, or a salt here?

I'm planning a demonstration of this feature, but would like to cite as many real world usages, or implementations as possible.

share|improve this question
I'm curious as well... most people don't even know about this attribute. Do you have a particular application for this, or are you just wanting to give a cool demo? – Steve Oct 17 '11 at 21:20
@SteveS The linked question references an application I'm independently building for sale. People want to know where the seed is stored/calculated so I want to show that other applications use this as well and also that I'm not being "creative" with security – LamonteCristo Oct 17 '11 at 21:25

I see that Stanford is using it as part of their bitlocker system recovery process Stanford link

For computers that are part of the Stanford Windows Infrastructure, a copy of the recovery password is stored with the computer object as a confidential attribute. By default, only Domain Administrators can see confidential attributes, no matter what access is granted by standard ACLs.

Looks like a great feature to leverage for Role Based Access Control but I don't have any examples at hand.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.