<div class="content"><p>The Group Key Distribution Protocol is used to obtain
cryptographic keys corresponding to arbitrary <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_e5213722-75a9-44e7-b026-8e4833f0d350" data-linktype="relative-path">security descriptors</a> that
can be evaluated by an <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_e467d927-17bf-49c9-98d1-96ddf61ddd90" data-linktype="relative-path">Active
Directory</a> <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_76a05049-3531-4abd-aec8-30e19954b4bd" data-linktype="relative-path">DC</a>. It can
be used to obtain symmetric as well as asymmetric keys for each of such
security descriptors. One possible use of this protocol is to obtain shared
keys for a set of <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_f3ef2572-95cf-4c5c-b3c9-551fd648f409" data-linktype="relative-path">security
principals</a> that are defined by the client in the form of a security
descriptor. Based on an evaluation of the client&#39;s <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_88d49f20-6c95-4b64-a52c-c3eca2fe5709" data-linktype="relative-path">security context</a> and the
security descriptor, the server can return an error, a <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_4cf96ca0-e3a9-4165-8d1a-a21b1397007a" data-linktype="relative-path">public key</a>, or a <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_b6877b45-4797-4f19-b90f-80f6d8652beb" data-linktype="relative-path">seed key</a> that can be used
to derive both the symmetric and asymmetric keys. Whenever the server returns a
key of any type, it also returns metadata that includes a unique identifier for
the key.</p><p>The Group Key Distribution Protocol utilizes a single <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_8a7f6700-8311-45bc-af10-82e10accd331" data-linktype="relative-path">remote procedure call (RPC)</a>
method that is described in section <a href="4cac87a3-521e-4918-a272-240f8fabed39" data-linktype="relative-path">3.1.4.1</a>. Conceptually,
this method can be used by a client for two types of requests:</p><ol><li><p><span>    </span>Requesting the
most recent key for a security descriptor: after evaluating the client&#39;s
security context against the specified security descriptor, the server will
return a seed key, a public key, or an error.</p>
</li><li><p><span>    </span>Requesting a
specific key for a security descriptor, or the key used for a set of security
principals at a specific time in the past: after evaluating the client&#39;s
security context against the specified security descriptor, the server will
return either a seed key or an error.</p>
</li></ol><p>Active Directory domain controllers with a DC functional
level of DS_BEHAVIOR_WIN2012 or higher can serve as Group Key Distribution
Protocol servers. Clients can locate Group Key Distribution Protocol servers by
using the DC locator functionality, as specified in section <a href="69de31b8-5e67-4421-b83b-8c260eef0647" data-linktype="relative-path">3.2.4.2</a>. These servers
store a small amount of state in Active Directory (sections <a href="a5232eff-f399-4823-b763-16bd3407b0d4" data-linktype="relative-path">2.3</a> and <a href="8e5bb0f3-6159-4816-8c92-d92b4f1123e0" data-linktype="relative-path">3.1.1</a>), which consists of
configuration information and one or more <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_c554a386-8f04-4557-be16-e1eff4918da6" data-linktype="relative-path">root key</a> <a href="c001759a-376b-4582-bb38-9fd1336ce4e3#gt_8bb43a65-7a8c-4585-a7ed-23044772f8ca" data-linktype="relative-path">objects</a>. Other than this,
Group Key Distribution Protocol servers retain no state across RPC calls.</p></div>