AD LDAP signing and channel binding
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit a3e1abf · +79 −68 lines · also on GitHub
11
---
2
−title: LDAP signing for Active Directory Domain Services on Windows Server
3
−description: Understand the role of LDAP signing and channel binding in verifying data integrity and preventing session hijacking in Active Directory.
4
−#customer intent: As an IT admin, I want to understand how to enable LDAP signing so that I can secure LDAP communications in my Active Directory environment.
2
+title: LDAP Signing Overview for Active Directory
3
+description: Learn how LDAP signing protects Active Directory LDAP sessions from tampering and replay attacks. Explore defaults by Windows Server version and event monitoring.
4
+#customer intent: As an IT admin, I want to understand how LDAP signing works so that I can protect LDAP communications from tampering and replay attacks in my Active Directory environment.
55
ms.topic: concept-article
6
−ms.date: 01/15/2026
6
+ms.date: 10/02/2026
77
author: robinharwood
88
ms.author: roharwoo
99
ms.reviewer: roharwoo
1010
ai-usage: ai-assisted
1111
---
1212
13
−# LDAP signing for Active Directory Domain Services
13
+# LDAP signing overview for Active Directory Domain Services
1414
15
−_LDAP signing_ is a security feature that cryptographically signs Lightweight Directory Access Protocol (LDAP) communications to verify data authenticity and integrity in Active Directory Domain Services (AD DS). _LDAP channel binding_ uses Channel Binding Tokens (CBT) to bind application-layer security with the underlying SSL/TLS session, preventing session hijacking and man-in-the-middle attacks. Together, these features protect LDAP traffic in AD DS environments from tampering, replay attacks, and unauthorized access.
15
+_LDAP signing_ is a security feature that cryptographically signs Lightweight Directory Access Protocol (LDAP) messages to verify their authenticity and integrity during Simple Authentication and Security Layer (SASL) sessions that don't use Transport Layer Security (TLS) in Active Directory Domain Services (AD DS) and Active Directory Lightweight Directory Services (AD LDS).
1616
17
−Administrators widely use LDAP to authenticate users and retrieve directory information in AD DS. Without proper security measures, intruders can intercept authentication attempts, modify packets in transit, or hijack encrypted sessions. LDAP signing and channel binding provide essential protection layers that ensure both clients and servers can trust the authenticity and integrity of their communications.
17
+If you use LDAP to authenticate users and retrieve directory information in AD DS, unsigned traffic leaves your environment vulnerable to attack. Bad actors can modify packets in transit, tamper with query responses, or inject messages that alter directory objects.
1818
19
−This article explains how LDAP signing and channel binding work, describes the security improvements Microsoft has introduced over time, and highlights new features in Windows Server 2025.
19
+This article explains how LDAP signing works, describes default behavior by Windows Server version, and covers event monitoring for troubleshooting.
2020
21
−## How LDAP signing works
21
+## What LDAP signing does and doesn't do
2222
23
−LDAP signing digitally signs LDAP messages to ensure that data isn't tampered with during transmission. When you enable LDAP signing, both the client and server cryptographically sign their communications. The process rejects any unsigned or improperly signed requests, preventing unauthorized modifications to LDAP messages.
23
+LDAP signing provides **integrity and authenticity** but not confidentiality. Attackers can still read signed LDAP messages sent over port 389 without TLS. To help protect confidentiality, use TLS (LDAPS or STARTTLS) or SASL sealing.
2424
25
−The signing process uses Simple Authentication and Security Layer (SASL) protocols, which include Negotiate, Kerberos, NTLM, and Digest protocols. When you enforce LDAP signing on a domain controller, it rejects SASL LDAP binds that don't request signing and rejects simple binds performed over nonencrypted connections.
25
+LDAP signing applies only to **non-TLS SASL sessions**. When you use TLS, it provides message integrity, so LDAP signing doesn't apply separately. Signing and TLS address the same need (integrity) in different contexts.
2626
27
−Unsigned LDAP traffic is vulnerable to:
27
+LDAP signing doesn't protect **simple binds**. The LDAP protocol layer doesn't protect simple-bind credentials, so use TLS to protect them in transit. This limitation is why Microsoft recommends SASL with Kerberos for LDAP authentication.
2828
29
−- **Replay attacks**: An intruder intercepts authentication attempts and tickets, then reuses them to impersonate legitimate users.
30
−- **Man-in-the-middle attacks**: An attacker captures packets between client and server, modifies them, and forwards altered requests to the domain controller.
29
+## How signing, encryption, and channel binding relate
3130
32
−By default, LDAP uses port 389. LDAP over SSL/TLS (LDAPS) uses port 636 and establishes encryption immediately upon connection.
31
+LDAP security involves four distinct protection layers, each addressing a different threat:
3332
34
−## How LDAP channel binding works
33
+| Protection layer | What it provides | When it applies |
34
+|---|---|---|
35
+| **LDAP signing** | Message integrity and authenticity | Non-TLS SASL sessions on port 389 |
36
+| **SASL sealing** | Confidentiality, integrity, and server identity | Non-TLS SASL sessions on port 389 |
37
+| **TLS (LDAPS / STARTTLS)** | Confidentiality, integrity, and server identity | All session types over TLS (port 636, or port 389 with STARTTLS) |
38
+| **Channel binding (CBT)** | Binds authentication to the specific TLS session, preventing credential relay | TLS + SASL sessions only (primarily protects against NTLM relay) |
3539
36
−LDAP channel binding uses Channel Binding Tokens (CBT) to cryptographically bind application-layer security (such as an SSL/TLS session) with the underlying network connection. This binding ensures that even if an attacker intercepts the encrypted session, they can't hijack or downgrade the connection.
40
+Each layer protects against different attacks and applies in different scenarios. For non-TLS environments, LDAP signing helps protect message integrity, and SASL sealing adds confidentiality. For TLS environments, CBT helps close the NTLM relay gap. For more information about channel binding, see [LDAP channel binding for AD DS](ldap-channel-binding.md).
3741
38
−Channel binding is important when you use NTLM or Simple Bind authentication over SSL/TLS. Without CBT enforcement, SSL/TLS encryption alone doesn't prevent all man-in-the-middle scenarios. An attacker positioned between client and server could potentially intercept the connection. By binding the security context directly to the SSL/TLS session, CBT ensures the session remains tamper-proof throughout its lifetime.
42
+## How LDAP signing works
3943
40
−When you enable channel binding:
44
+LDAP signing digitally signs LDAP messages to help ensure that data isn't tampered with during transmission. When you enable LDAP signing, both the client and server cryptographically sign their communications. The process rejects any unsigned or improperly signed requests, preventing unauthorized modifications to LDAP messages.
4145
42
−1. The client establishes an SSL/TLS connection to the LDAP server.
43
−1. A Channel Binding Token is generated based on the SSL/TLS session parameters.
44
−1. The client includes this token when authenticating.
45
−1. The server validates that the token matches the current SSL/TLS session.
46
−1. If tokens mismatch or are missing when required, the connection is rejected.
46
+The signing process uses Simple Authentication and Security Layer (SASL) protocols, including Kerberos, NTLM, and Digest. NTLM and Digest are deprecated, so use Kerberos instead. When you enforce LDAP signing on a domain controller, it rejects SASL LDAP binds that don't request signing and rejects simple binds over unencrypted connections.
4747
48
−## Default security behavior
48
+## Default LDAP signing behavior
4949
50
−The default LDAP security settings vary depending on your Windows Server version and deployment type. You can configure LDAP signing and channel binding through Group Policy settings on domain controllers and client computers. For more information about managing these policies, see [Manage LDAP signing using Group Policy](../manage-ldap-signing-group-policy.md).
50
+The default LDAP signing settings depend on your Windows Server version and deployment type. Configure LDAP signing through Group Policy settings on domain controllers and client computers. To manage these policies, see [Manage LDAP signing by using Group Policy](../manage-ldap-signing-group-policy.md).
5151
52
−### Windows Server 2025 and later
52
+### Windows Server 2025 or later
5353
54
−Windows Server 2025 and later significantly strengthens the default security posture for new deployments:
54
+Windows Server 2025 or later requires LDAP signing by default for new Active Directory deployments. Two policies control server-side signing:
5555
56
−- **LDAP signing**: All new Active Directory deployments require LDAP signing by default through the "Domain controller: LDAP server signing requirements enforcement" policy.
57
−- **LDAP channel binding**: Set to "When supported" by default; domain controllers accept channel binding when clients provide it.
58
−- **LDAP client encryption**: Preferred by default.
59
−- **Channel binding auditing**: Enabled by default.
56
+- **Domain controller: LDAP server signing requirements**: sets the signing level, with **None** and **Require signing** options.
57
+- **Domain controller: LDAP server signing requirements enforcement**: enabled by default on new deployments. When enabled, it enforces signing and takes precedence over the signing-level policy.
6058
61
−These enhanced defaults protect new environments immediately upon deployment and are compatible with clients that support modern security features.
59
+Client-side defaults also change:
6260
63
−### Windows Server 2019 and earlier
61
+- **LDAP client signing**: Windows Server 2025 or later LDAP clients use encrypted connections by default. When encryption is active, SASL sealing or TLS provides message integrity, so LDAP signing doesn't apply separately. For unencrypted connections, the client requests signing by default.
6462
65
−In Windows Server 2019 and earlier, LDAP security features are available but not enforced by default:
63
+### Windows Server 2022 or earlier
6664
67
−- **LDAP signing**: Optional by default; domain controllers accept both signed and unsigned LDAP binds.
68
−- **LDAP channel binding**: Set to "Never" by default; domain controllers don't require Channel Binding Tokens.
69
−- **Client behavior**: Windows clients prefer encrypted connections but fall back to unencrypted if necessary.
65
+Windows Server 2022 or earlier makes LDAP security features available but doesn't enforce them by default:
7066
71
−This permissive default allows compatibility with legacy applications and devices but requires administrators to manually enable security features to protect against man-in-the-middle attacks and session hijacking.
67
+- **LDAP server signing**: optional by default; domain controllers accept both signed and unsigned LDAP binds.
68
+- **LDAP client signing**: Windows Server 2022 or earlier LDAP clients request signing by default but can fall back to unencrypted, unsigned connections. When the connection is unencrypted, signing is the primary integrity protection.
7269
70
+This permissive default setting supports existing applications and devices but requires administrators to manually enable LDAP signing to protect against man-in-the-middle and replay attacks.
71
+
72
+### Windows client versions
73
+
74
+Client LDAP signing behavior varies by Windows version.
75
+
76
+#### Windows 11, version 24H2 or later
77
+
78
+Windows 11, version 24H2 or later encrypts LDAP connections by default. When encryption is active, SASL sealing or TLS provides message integrity, so LDAP signing doesn't apply separately. These clients also support LDAP signing for connections that don't use encrypted communication.
79
+
80
+#### Earlier Windows client versions
81
+
82
+Earlier Windows clients use unencrypted connections by default, making LDAP signing the primary integrity protection for these clients. The client application controls the use of encryption. All earlier versions of Windows request LDAP signing by default as LDAP clients.
83
+
7384
### Upgrade considerations
7485
7586
When you upgrade from earlier Windows Server versions to Windows Server 2025:
7687
77
−- **Existing policies preserved**: Upgrade installations maintain their current LDAP security settings to prevent disruption.
78
−- **Gradual enforcement recommended**: Evaluate client compatibility by using event monitoring before enabling signing or channel binding requirements.
79
−- **Migration path**: Start with "When supported" for channel binding and "Negotiate signing" for signing, then move to full enforcement after validating compatibility.
88
+- **Existing policies preserved**: if you have LDAP server-side or client-side signing policies in place, the upgrade maintains your current settings to prevent disruption.
89
+- **No server policy set**: if no LDAP server signing policy exists, Windows Server 2025 requires LDAP signing by default.
90
+- **Gradually enforce**: evaluate client compatibility by using event monitoring before requiring LDAP signing.
91
+- **Migration path**: monitor `Event IDs 2887 and 2889` to identify unsigned clients, configure those clients to request signing, and then move to **Require signing** after validating compatibility.
8092
81
−For more information about the history of LDAP signing and channel binding policy changes in Windows, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
93
+For more information about the history of LDAP signing policy changes in Windows, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
8294
83
−## Event monitoring
95
+## LDAP signing event monitoring
8496
85
−LDAP signing and channel binding generate specific events that help you monitor security status and troubleshoot connectivity problems. You can see these events in Event Viewer under the Directory Service category.
97
+LDAP signing generates specific events that help you monitor security status and troubleshoot connectivity problems. View these events in Event Viewer under **Applications and Services Logs** > **Directory Service**.
8698
87
−### LDAP signing events
99
+| Event ID | Description | Recommended action |
100
+|----------|-------------|-------------------|
101
+| 2886 | Logged at Directory Service startup. Warns that the domain controller (DC) doesn't reject unsigned SASL binds or clear-text simple binds. | Evaluate client compatibility and consider requiring signing. |
102
+| 2887 | 24-hour summary of unsigned SASL binds and clear-text simple binds that the DC **permitted**. | Investigate which clients are making unsigned binds. Enable diagnostic logging (Event 2889) to identify specific clients. |
103
+| 2888 | 24-hour summary of unsigned SASL binds and clear-text simple binds that the DC **rejected** because signing is enforced. | No immediate action needed; signing is working as configured. Review rejected client counts to track migration progress. |
104
+| 2889 | Per-client detail: logs the IP address and identity of each client that attempted an unsigned or clear-text bind. To log this event, set the **16 LDAP Interface Events** diagnostic level to **2** (Basic). | Identify and update the specific clients. Disable diagnostic logging after investigation to avoid a performance impact. |
88105
89
−| Event ID | Name | Description | Recommended action |
90
−|----------|------|-------------|-------------------|
91
−| 2886 | LDAP signing not required | Domain controller accepts unsigned LDAP communications | Evaluate client compatibility and consider requiring signing |
92
−| 2887 | Unsigned LDAP binds detected | Client made unsigned simple bind or SASL bind without SSL/TLS | Investigate client; configure to use LDAPS or signed LDAP |
93
−| 2888 | LDAP signing disabled | Domain controller accepts all unsigned traffic (highly vulnerable) | Immediately enable LDAP signing to protect environment |
94
−| 2889 | Signed LDAP communications | Domain controller successfully processed signed LDAP request | No action needed; indicates secure traffic |
106
+For channel binding events (3039-3041, 3074-3075), see [LDAP channel binding for AD DS](ldap-channel-binding.md).
95107
96
−### LDAP channel binding events
108
+### Event monitoring considerations
97109
98
−| Event ID | Name | Description | Recommended action |
99
−|----------|------|-------------|-------------------|
100
−| 3039 | Channel binding not supported | Client doesn't support CBT when policy requires it | Update client or temporarily adjust policy during migration |
101
−| 3040 | Channel binding failure | Client attempted CBT but binding failed (token mismatch) | Verify SSL/TLS certificates and network configuration |
102
−| 3041 | Channel binding successful | Client successfully used channel binding | No action needed; indicates secure communication |
110
+New Windows Server 2025 deployments require signing by default. When you enable signing on Windows Server 2022 or earlier, or in upgraded environments that kept the previous policy, consider these monitoring and compatibility factors:
103111
104
−### Event troubleshooting workflow
112
+- **Auditing**: **Advanced Audit Policy Configuration** in **Group Policy** under **Audit Directory Service Access** provides auditing for the deployment.
113
+- **Regular monitoring**: Event Viewer under **Applications and Services Logs** > **Directory Service** shows events `2886` through `2889`.
114
+- **Client identification**: Event 2887 reports the number of unsigned binds. Diagnostic logging captures Event 2889, which records each unsigned bind attempt, including the client IP address and identity.
115
+- **Gradual implementation**: **Negotiate signing** helps identify unsigned clients before you switch to **Require signing** after verifying client compatibility.
116
+- **Audit mode**: An audit-only deployment identifies incompatible clients before enforcement.
117
+- **Noncompliant clients**: Clients that can't support signing require an upgrade or replacement. Isolate these clients on separate network segments if necessary.
105118
106
−1. **Enable auditing**: Configure Advanced Audit Policy Configuration in Group Policy under Audit Directory Service Access.
107
−1. **Monitor logs regularly**: Check Event Viewer > Directory Service for events 2886-2889 and 3039-3041.
108
−1. **Identify problematic clients**: Investigate sources of Event 2887 or 3039. Update client configurations to support signing and channel binding.
109
−1. **Implement gradually**: Start with "Negotiate signing" and "When supported" policies, then move to full enforcement after verifying client compatibility.
110
−1. **Use audit mode**: Deploy changes in audit-only mode first to identify incompatible clients before enforcing.
111
−1. **Update legacy systems**: Upgrade or replace clients that can't support signing or channel binding. Isolate them on separate network segments if necessary.
119
+For step-by-step troubleshooting guidance, see [How to enable LDAP signing in Windows Server](/troubleshoot/windows-server/active-directory/enable-ldap-signing-in-windows-server).
112120
113121
## LDAP client performance counters
114122
115
−Windows Server 2025 and Windows 11 version 24H2 introduce LDAP client performance counters that provide detailed visibility into LDAP client operations. These counters monitor binds, connections, operations, requests, responses, and searches per process on the local client machine. You can assess multiple processes simultaneously, helping you identify performance bottlenecks, troubleshoot Active Directory performance problems, and optimize LDAP client behavior in production environments.
123
+Windows Server 2025 and Windows 11 version 24H2 introduce LDAP client performance counters that show detailed information about LDAP client operations. These counters monitor binds, connections, operations, requests, responses, and searches per process on the local client machine. Assess multiple processes simultaneously to identify performance bottlenecks, troubleshoot Active Directory performance problems, and optimize LDAP client behavior in production environments.
116124
117125
For more information about LDAP client performance counters, see [Active Directory LDAP client performance counters](ldap-client-performance-counters.md).
118126
119127
## Next steps
120128
121
−> [!div class="nextstepaction"]
122
−> [Configure certificates for LDAP over SSL](configure-ldap-signing-certificates.md)
129
+- [LDAP channel binding for AD DS](ldap-channel-binding.md)
130
+- [Configure certificates for LDAP over SSL](configure-ldap-signing-certificates.md)
131
+- [Manage LDAP signing by using Group Policy](../manage-ldap-signing-group-policy.md)
132
+- [How to enable LDAP signing in Windows Server](/troubleshoot/windows-server/active-directory/enable-ldap-signing-in-windows-server)
133
+- [Active Directory LDAP client performance counters](ldap-client-performance-counters.md)
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.