Skip to content

Update LDAP signing configuration instructions #8142

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
HerbertMauerer wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Update LDAP signing configuration instructions #8142

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
17 changes: 16 additions & 1 deletion WindowsServerDocs/identity/manage-ldap-signing-group-policy.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -44,11 +44,13 @@ To enable detailed logging that identifies specific client IP addresses:
1. Set the **16 LDAP Interface Events** value to **2** (Basic logging).
1. Monitor for Event ID 2889, which logs each unsigned bind attempt including the client IP address and identity.

**Note:** The eventlog and registry path names have the LDS instance name for LDS servers.

After you identify all clients that need updates, configure them to request LDAP signing before you enforce signing requirements on your domain controllers.

## Configure LDAP signing requirements

Configure LDAP signing on both domain controllers and client computers to ensure secure LDAP communications across your environment.
Configure LDAP signing on both servers (domain controllers and LDS servers) and client computers to ensure secure LDAP communications across your environment.

### Client computers

Expand Down Expand Up @@ -142,6 +144,19 @@ The setting takes effect immediately without needing a restart. The **LDAPServer
- **0**: Signing is disabled (default)
- **2**: Signing is required

To configure LDAP signing enforcement for an AD LDS instance:

1. Open **Registry Editor** on the server hosting the AD LDS instance.
1. Go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<InstanceName>\Parameters`.
1. Create a new **DWORD (32-bit) Value** named **LDAPServerEnforceIntegrity**.
1. Set the value to **1** to enable signing requirements.
1. Close **Registry Editor**.

The setting takes effect immediately without needing a restart. The **LDAPServerIntegrity** value accepts the following values:

- **0**: Signing behavior follows registry entry LDAPServerIntegrity
- **1**: Signing is required (default)

## Verify LDAP signing configuration

After you configure LDAP signing requirements, verify that the configuration works as expected. You can test this verification by attempting an unsigned LDAP bind. If signing is properly configured, the domain controller rejects the bind.
Expand Down