ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 00:57 UTC Customize Public modeDiscuss ChangeIntel on Discord

AD LDAP signing and channel binding

This page's changes and edits · All guidance changes

Microsoft's edit ·

Editorial updates

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 6940c95 · +43 −43 lines · also on GitHub

⋯ 2 unchanged lines
33 description: Understand the role of LDAP signing and channel binding in verifying data integrity and preventing session hijacking in Active Directory.
44 #customer intent: As an IT admin, I want to understand how to enable LDAP signing so that I can secure LDAP communications in my Active Directory environment.
55 ms.topic: concept-article
6 −ms.date: 12/16/2025
6 +ms.date: 12/18/2025
77 author: robinharwood
88 ms.author: roharwoo
99 ms.reviewer: roharwoo
10 +ai-usage: ai-assisted
1011 ---
1112
1213 # LDAP signing for Active Directory Domain Services
1314
1415 _LDAP signing_ is a security feature that cryptographically signs Lightweight Directory Access Protocol (LDAP) communications to verify data authenticity and integrity in Active Directory Domain Services (AD DS). _LDAP channel binding_ uses Channel Binding Tokens (CBT) to bind application-layer security with the underlying SSL/TLS session, preventing session hijacking and man-in-the-middle attacks. Together, these features protect LDAP traffic in AD DS environments from tampering, replay attacks, and unauthorized access.
1516
16 −LDAP is widely used to authenticate users and retrieve directory information in AD DS. Without proper security measures, LDAP communications are vulnerable to attacks where intruders intercept authentication attempts, modify packets in transit, or hijack encrypted sessions. LDAP signing and channel binding provide essential protection layers that ensure both clients and servers can trust the authenticity and integrity of their communications.
17 +Administrators widely use LDAP to authenticate users and retrieve directory information in AD DS. Without proper security measures, intruders can intercept authentication attempts, modify packets in transit, or hijack encrypted sessions. LDAP signing and channel binding provide essential protection layers that ensure both clients and servers can trust the authenticity and integrity of their communications.
1718
1819 This article explains how LDAP signing and channel binding work, describes the security improvements Microsoft has introduced over time, and highlights new features in Windows Server 2025.
1920
2021 ## How LDAP signing works
2122
22 −LDAP signing digitally signs LDAP messages to ensure that data hasn't been tampered with during transmission. When you enable LDAP signing, both the client and server cryptographically sign their communications. Any unsigned or improperly signed requests are rejected, preventing unauthorized modifications to LDAP messages.
23 +LDAP signing digitally signs LDAP messages to ensure that data isn't tampered with during transmission. When you enable LDAP signing, both the client and server cryptographically sign their communications. The process rejects any unsigned or improperly signed requests, preventing unauthorized modifications to LDAP messages.
2324
24 −The signing process uses Simple Authentication and Security Layer (SASL) protocols, which include Negotiate, Kerberos, NTLM, and Digest protocols. When LDAP signing is enforced on a domain controller, it rejects SASL LDAP binds that don't request signing and rejects simple binds performed over non-encrypted connections.
25 +The signing process uses Simple Authentication and Security Layer (SASL) protocols, which include Negotiate, Kerberos, NTLM, and Digest protocols. When you enforce LDAP signing on a domain controller, it rejects SASL LDAP binds that don't request signing and rejects simple binds performed over nonencrypted connections.
2526
2627 Unsigned LDAP traffic is vulnerable to:
2728
28 −- **Replay attacks**: An intruder intercepts authentication attempts and tickets, then reuses them to impersonate legitimate users
29 −- **Man-in-the-middle attacks**: An attacker captures packets between client and server, modifies them, and forwards altered requests to the domain controller
29 +- **Replay attacks**: An intruder intercepts authentication attempts and tickets, then reuses them to impersonate legitimate users.
30 +- **Man-in-the-middle attacks**: An attacker captures packets between client and server, modifies them, and forwards altered requests to the domain controller.
3031
3132 By default, LDAP uses port 389. LDAP over SSL/TLS (LDAPS) uses port 636 and establishes encryption immediately upon connection.
3233
⋯ 1 unchanged line
3435
3536 LDAP channel binding uses Channel Binding Tokens (CBT) to cryptographically bind application-layer security (such as an SSL/TLS session) with the underlying network connection. This binding ensures that even if an attacker intercepts the encrypted session, they can't hijack or downgrade the connection.
3637
37 −Channel binding is particularly important when using NTLM or Simple Bind authentication over SSL/TLS. Without CBT enforcement, SSL/TLS encryption alone doesn't prevent all man-in-the-middle scenarios. An attacker positioned between client and server could potentially intercept the connection. By binding the security context directly to the SSL/TLS session, CBT ensures the session remains tamper-proof throughout its lifetime.
38 +Channel binding is important when you use NTLM or Simple Bind authentication over SSL/TLS. Without CBT enforcement, SSL/TLS encryption alone doesn't prevent all man-in-the-middle scenarios. An attacker positioned between client and server could potentially intercept the connection. By binding the security context directly to the SSL/TLS session, CBT ensures the session remains tamper-proof throughout its lifetime.
3839
39 −When channel binding is enabled:
40 +When you enable channel binding:
4041
41 −1. The client establishes an SSL/TLS connection to the LDAP server
42 −2. A Channel Binding Token is generated based on the SSL/TLS session parameters
43 −3. The client includes this token when authenticating
44 −4. The server validates that the token matches the current SSL/TLS session
45 −5. If tokens mismatch or are missing when required, the connection is rejected
42 +1. The client establishes an SSL/TLS connection to the LDAP server.
43 +1. A Channel Binding Token is generated based on the SSL/TLS session parameters.
44 +1. The client includes this token when authenticating.
45 +1. The server validates that the token matches the current SSL/TLS session.
46 +1. If tokens mismatch or are missing when required, the connection is rejected.
4647
4748 ## Default security behavior
4849
⋯ 1 unchanged line
5051
5152 ### Windows Server 2019 and earlier
5253
53 −In Windows Server versions prior to 2025, LDAP security features are available but not enforced by default:
54 +In Windows Server 2019 and earlier, LDAP security features are available but not enforced by default:
5455
55 −- **LDAP signing**: Optional by default; domain controllers accept both signed and unsigned LDAP binds
56 −- **LDAP channel binding**: Set to "Never" by default; domain controllers don't require Channel Binding Tokens
57 −- **Client behavior**: Windows clients prefer encrypted connections but fall back to unencrypted if necessary
56 +- **LDAP signing**: Optional by default; domain controllers accept both signed and unsigned LDAP binds.
57 +- **LDAP channel binding**: Set to "Never" by default; domain controllers don't require Channel Binding Tokens.
58 +- **Client behavior**: Windows clients prefer encrypted connections but fall back to unencrypted if necessary.
5859
59 −This permissive default allowed compatibility with legacy applications and devices but required administrators to manually enable security features to protect against man-in-the-middle attacks and session hijacking.
60 +This permissive default allows compatibility with legacy applications and devices but requires administrators to manually enable security features to protect against man-in-the-middle attacks and session hijacking.
6061
6162 ### Windows Server 2025 and later
6263
63 −Windows Server 2025 and later significantly strengthens default security posture for new deployments:
64 +Windows Server 2025 and later significantly strengthens the default security posture for new deployments:
6465
65 −- **LDAP signing**: Mandatory by default for all new Active Directory deployments through the "Domain controller: LDAP server signing requirements enforcement" policy
66 −- **LDAP channel binding**: Set to "When supported" by default; domain controllers accept channel binding when clients provide it
67 −- **LDAP client encryption**: Preferred by default
68 −- **Channel binding auditing**: Enabled by default
66 +- **LDAP signing**: All new Active Directory deployments require LDAP signing by default through the "Domain controller: LDAP server signing requirements enforcement" policy.
67 +- **LDAP channel binding**: Set to "When supported" by default; domain controllers accept channel binding when clients provide it.
68 +- **LDAP client encryption**: Preferred by default.
69 +- **Channel binding auditing**: Enabled by default.
6970
70 −These enhanced defaults protect new environments immediately upon deployment, compatible with clients that support modern security features.
71 +These enhanced defaults protect new environments immediately upon deployment and are compatible with clients that support modern security features.
7172
7273 ### Upgrade considerations
7374
7475 When you upgrade from earlier Windows Server versions to Windows Server 2025:
7576
76 −- **Existing policies preserved**: Upgrade installations maintain their current LDAP security settings to prevent disruption
77 −- **Gradual enforcement recommended**: Evaluate client compatibility using event monitoring before enabling signing or channel binding requirements
78 −- **Migration path**: Start with "When supported" for channel binding and "Negotiate signing" for signing, then move to full enforcement after validating compatibility
77 +- **Existing policies preserved**: Upgrade installations maintain their current LDAP security settings to prevent disruption.
78 +- **Gradual enforcement recommended**: Evaluate client compatibility by using event monitoring before enabling signing or channel binding requirements.
79 +- **Migration path**: Start with "When supported" for channel binding and "Negotiate signing" for signing, then move to full enforcement after validating compatibility.
7980
80 −To learn more about the evolution of these requirements and specific deployment timelines, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
81 +For more information about the evolution of these requirements and specific deployment timelines, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
8182
8283 ## Group policy settings
8384
⋯ 31 unchanged lines
115116
116117 ## Event monitoring
117118
118 −LDAP signing and channel binding generate specific events that help you monitor security status and troubleshoot connectivity issues. These events appear in Event Viewer under the Directory Service category.
119 +LDAP signing and channel binding generate specific events that help you monitor security status and troubleshoot connectivity problems. You can see these events in Event Viewer under the Directory Service category.
119120
120121 ### LDAP signing events
121122
122123 | Event ID | Name | Description | Recommended action |
123124 |----------|------|-------------|-------------------|
124 −| 2886 | LDAP signing not required | Domain controller allows unsigned LDAP communications | Evaluate client compatibility and consider requiring signing |
125 +| 2886 | LDAP signing not required | Domain controller accepts unsigned LDAP communications | Evaluate client compatibility and consider requiring signing |
125126 | 2887 | Unsigned LDAP binds detected | Client made unsigned simple bind or SASL bind without SSL/TLS | Investigate client; configure to use LDAPS or signed LDAP |
126 −| 2888 | LDAP signing disabled | Domain controller allows all unsigned traffic (highly vulnerable) | Immediately enable LDAP signing to protect environment |
127 +| 2888 | LDAP signing disabled | Domain controller accepts all unsigned traffic (highly vulnerable) | Immediately enable LDAP signing to protect environment |
127128 | 2889 | Signed LDAP communications | Domain controller successfully processed signed LDAP request | No action needed; indicates secure traffic |
128129
129130 ### LDAP channel binding events
⋯ 6 unchanged lines
136137
137138 ### Event troubleshooting workflow
138139
139 −1. **Enable auditing**: Configure Advanced Audit Policy Configuration in Group Policy under Audit Directory Service Access
140 −2. **Monitor logs regularly**: Check Event Viewer > Directory Service for events 2886-2889 and 3039-3041
141 −3. **Identify problematic clients**: Investigate sources of Event 2887 or 3039; update client configurations to support signing and channel binding
142 −4. **Implement gradually**: Start with "Negotiate signing" and "When supported" policies, then move to full enforcement after verifying client compatibility
143 −5. **Use audit mode**: Deploy changes in audit-only mode first to identify incompatible clients before enforcing
144 −6. **Update legacy systems**: Upgrade or replace clients that can't support signing or channel binding; isolate them on separate network segments if necessary
140 +1. **Enable auditing**: Configure Advanced Audit Policy Configuration in Group Policy under Audit Directory Service Access.
141 +1. **Monitor logs regularly**: Check Event Viewer > Directory Service for events 2886-2889 and 3039-3041.
142 +1. **Identify problematic clients**: Investigate sources of Event 2887 or 3039. Update client configurations to support signing and channel binding.
143 +1. **Implement gradually**: Start with "Negotiate signing" and "When supported" policies, then move to full enforcement after verifying client compatibility.
144 +1. **Use audit mode**: Deploy changes in audit-only mode first to identify incompatible clients before enforcing.
145 +1. **Update legacy systems**: Upgrade or replace clients that can't support signing or channel binding. Isolate them on separate network segments if necessary.
145146
146147 ## LDAP client performance counters
147148
148 −Windows Server 2025 and Windows 11 version 24H2 introduce LDAP client performance counters that provide detailed visibility into LDAP client operations. These counters monitor binds, connections, operations, requests, responses, and searches per process on the local client machine. Multiple processes can be assessed simultaneously, helping you identify performance bottlenecks, troubleshoot Active Directory performance issues, and optimize LDAP client behavior in production environments.
149 +Windows Server 2025 and Windows 11 version 24H2 introduce LDAP client performance counters that provide detailed visibility into LDAP client operations. These counters monitor binds, connections, operations, requests, responses, and searches per process on the local client machine. You can assess multiple processes simultaneously, helping you identify performance bottlenecks, troubleshoot Active Directory performance problems, and optimize LDAP client behavior in production environments.
149150
150 −To learn more about LDAP client performance counters, see [Active Directory LDAP client performance counters](ldap-client-performance-counters.md).
151 +For more information about LDAP client performance counters, see [Active Directory LDAP client performance counters](ldap-client-performance-counters.md).
151152
152 −## Related content
153 +## Next steps
153154
154 −- [How to enable LDAP signing in Windows Server](/troubleshoot/windows-server/active-directory/enable-ldap-signing-in-windows-server)
155 −- [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a)
156 −- [Frequently asked questions about changes to Lightweight Directory Access Protocol](https://support.microsoft.com/topic/frequently-asked-questions-about-changes-to-lightweight-directory-access-protocol-41a40287-810a-e799-d067-f578fca055fc)
155 +> [!div class="nextstepaction"]
156 +> [Configure certificates for LDAP over SSL](configure-ldap-signing-certificates.md)

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 21 Oct 00:57 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.