AD LDAP signing and channel binding
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 7da5601 · +13 −47 lines · also on GitHub
⋯ 2 unchanged lines
33
description: Understand the role of LDAP signing and channel binding in verifying data integrity and preventing session hijacking in Active Directory.
44
#customer intent: As an IT admin, I want to understand how to enable LDAP signing so that I can secure LDAP communications in my Active Directory environment.
55
ms.topic: concept-article
6
−ms.date: 12/18/2025
6
+ms.date: 01/15/2026
77
author: robinharwood
88
ms.author: roharwoo
99
ms.reviewer: roharwoo
⋯ 37 unchanged lines
4747
4848
## Default security behavior
4949
50
−The default LDAP security settings vary depending on your Windows Server version and deployment type.
51
−
52
−### Windows Server 2019 and earlier
53
−
54
−In Windows Server 2019 and earlier, LDAP security features are available but not enforced by default:
55
−
56
−- **LDAP signing**: Optional by default; domain controllers accept both signed and unsigned LDAP binds.
57
−- **LDAP channel binding**: Set to "Never" by default; domain controllers don't require Channel Binding Tokens.
58
−- **Client behavior**: Windows clients prefer encrypted connections but fall back to unencrypted if necessary.
59
−
60
−This permissive default allows compatibility with legacy applications and devices but requires administrators to manually enable security features to protect against man-in-the-middle attacks and session hijacking.
50
+The default LDAP security settings vary depending on your Windows Server version and deployment type. You can configure LDAP signing and channel binding through Group Policy settings on domain controllers and client computers. For more information about managing these policies, see [Manage LDAP signing using Group Policy](../manage-ldap-signing-group-policy.md).
6151
6252
### Windows Server 2025 and later
6353
⋯ 6 unchanged lines
7060
7161
These enhanced defaults protect new environments immediately upon deployment and are compatible with clients that support modern security features.
7262
63
+### Windows Server 2019 and earlier
64
+
65
+In Windows Server 2019 and earlier, LDAP security features are available but not enforced by default:
66
+
67
+- **LDAP signing**: Optional by default; domain controllers accept both signed and unsigned LDAP binds.
68
+- **LDAP channel binding**: Set to "Never" by default; domain controllers don't require Channel Binding Tokens.
69
+- **Client behavior**: Windows clients prefer encrypted connections but fall back to unencrypted if necessary.
70
+
71
+This permissive default allows compatibility with legacy applications and devices but requires administrators to manually enable security features to protect against man-in-the-middle attacks and session hijacking.
72
+
7373
### Upgrade considerations
7474
7575
When you upgrade from earlier Windows Server versions to Windows Server 2025:
⋯ 2 unchanged lines
7878
- **Gradual enforcement recommended**: Evaluate client compatibility by using event monitoring before enabling signing or channel binding requirements.
7979
- **Migration path**: Start with "When supported" for channel binding and "Negotiate signing" for signing, then move to full enforcement after validating compatibility.
8080
81
−For more information about the evolution of these requirements and specific deployment timelines, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
82
−
83
−## Group policy settings
84
−
85
−You can configure LDAP signing and channel binding through Group Policy settings on domain controllers and client computers.
86
−
87
−### LDAP signing policies
88
−
89
−**Domain controller policy:**
90
−
91
−- **Path**: Default Domain Controller Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
92
−- **Setting**: Domain controller: LDAP server signing requirements
93
−- **Options**:
94
− - **None**: Doesn't require signing (vulnerable to attacks)
95
− - **Require signing**: Rejects unsigned LDAP binds
96
−
97
−**Client policy:**
98
−
99
−- **Path**: Local Computer Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
100
−- **Setting**: Network security: LDAP client signing requirements
101
−- **Options**:
102
− - **None**: Client doesn't request signing
103
− - **Negotiate signing**: Client requests signing if server supports it
104
− - **Require signing**: Client requires signing for all LDAP traffic
105
−
106
−### LDAP channel binding policy
107
−
108
−**Domain controller policy:**
109
−
110
−- **Path**: Default Domain Controller Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
111
−- **Setting**: Domain controller: LDAP server channel binding token requirements
112
−- **Options**:
113
− - **Never**: Doesn't require channel binding
114
− - **When supported**: Accepts channel binding when clients provide it
115
− - **Always**: Requires channel binding for all connections
81
+For more information about the history of LDAP signing and channel binding policy changes in Windows, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
11682
11783
## Event monitoring
11884
⋯ 38 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.