ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

AD LDAP signing enforcement policies

This page's changes and edits · All guidance changes

Microsoft's edit ·

Editorial updates

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 6940c95 · +27 −27 lines · also on GitHub

11 ---
2 −title: Manage LDAP signing using Group Policy
2 +title: Manage LDAP signing using Group Policy for Active Directory Domain Service
33 description: Learn how to configure LDAP signing requirements on Windows Server domain controllers using Group Policy to enhance security and prevent unauthorized access.
44 author: robinharwood
55 ms.author: roharwoo
66 ms.service: windows-server
77 ms.topic: how-to
8 −ms.date: 12/17/2025
9 −
8 +ms.date: 12/18/2025
9 +ai-usage: ai-assisted
1010 #CustomerIntent: As a domain administrator, I want to configure LDAP signing requirements on my domain controllers so that I can protect my Active Directory environment from replay and man-in-the-middle attacks.
1111 ---
1212
13 −# Manage LDAP signing using Group Policy
13 +# Manage LDAP signing using Group Policy for Active Directory Domain Service
1414
1515 Configuring your domain controllers to require LDAP signing significantly improves the security of your Active Directory environment by rejecting unsigned LDAP binds. This article shows you how to configure LDAP server signing requirements using Group Policy and how to identify clients that need to be updated before enforcing this security requirement.
1616
⋯ 10 unchanged lines
2727
2828 ## Identify clients using unsigned LDAP binds
2929
30 −Before requiring LDAP signing, you should identify which clients in your environment are currently making unsigned LDAP binds. Active Directory logs summary events to help you discover these clients without disrupting service.
30 +Before you require LDAP signing, identify which clients in your environment are currently making unsigned LDAP binds. Active Directory logs summary events to help you discover these clients without disrupting service.
3131
3232 By default, domain controllers log Event ID 2887 once every 24 hours when unsigned binds occur. This event provides summary information about the number of unsigned simple binds and unsigned SASL binds detected.
3333
3434 To get detailed information about specific clients making unsigned binds:
3535
3636 1. Open **Event Viewer** on the domain controller.
37 −1. Navigate to **Applications and Services Logs** > **Directory Service**.
37 +1. Go to **Applications and Services Logs** > **Directory Service**.
3838 1. Look for Event ID 2887 to see summary information about unsigned binds.
3939
4040 To enable detailed logging that identifies specific client IP addresses:
4141
4242 1. Open **Registry Editor** on the domain controller.
43 −1. Navigate to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics`.
43 +1. Go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics`.
4444 1. Set the **16 LDAP Interface Events** value to **2** (Basic logging).
4545 1. Monitor for Event ID 2889, which logs each unsigned bind attempt including the client IP address and identity.
4646
47 −After identifying all clients that require updates, configure them to request LDAP signing before proceeding to enforce signing requirements on your domain controllers.
47 +After you identify all clients that need updates, configure them to request LDAP signing before you enforce signing requirements on your domain controllers.
4848
4949 ## Configure LDAP signing requirements
5050
⋯ 1 unchanged line
5252
5353 ### Client computers
5454
55 −Client computers need to be configured to request LDAP signing when communicating with domain controllers. This can be configured using local policy on individual computers or through a domain Group Policy Object for enterprise-wide deployment. We recommend configuring clients before enforcing signing on domain controllers to prevent service disruptions. You can verify client compliance by repeating the steps in the previous [Identify clients using unsigned LDAP binds](#identify-clients-using-unsigned-ldap-binds) section to check for unsigned bind attempts.
55 +You need to configure client computers to request LDAP signing when they communicate with domain controllers. You can set this up by using local policy on individual computers or through a domain Group Policy Object for enterprise-wide deployment. To prevent service disruptions, configure clients before you enforce signing on domain controllers. You can verify client compliance by repeating the steps in the previous [Identify clients using unsigned LDAP binds](#identify-clients-using-unsigned-ldap-binds) section to check for unsigned bind attempts.
5656
5757 To configure LDAP signing on client computers using Group Policy:
5858
5959 1. Open **Microsoft Management Console** by selecting **Start** > **Run**, typing **mmc.exe**, and selecting **OK**.
6060 1. Select **File** > **Add/Remove Snap-in**.
61 −1. Select **Group Policy Object Editor**, then select **Add**.
61 +1. Select **Group Policy Object Editor**, and then select **Add**.
6262 1. Select **Browse**, and then select **Default Domain Policy** or your preferred Group Policy Object.
63 −1. Select **OK**, then select **Finish**.
64 −1. Select **Close**, then select **OK**.
63 +1. Select **OK**, and then select **Finish**.
64 +1. Select **Close**, and then select **OK**.
6565 1. Navigate to **Default Domain Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
6666 1. Right-click **Network security: LDAP client signing requirements**, and select **Properties**.
6767 1. Select one of the following options:
⋯ 3 unchanged lines
7171 1. Select **OK**.
7272 1. Select **Yes** in the confirmation dialog.
7373
74 −After configuring this setting, client computers will request LDAP signing based on the selected policy. The policy takes effect at the next Group Policy refresh or can be applied immediately using `gpupdate /force`.
74 +After you configure this setting, client computers request LDAP signing based on the selected policy. The policy takes effect at the next Group Policy refresh or can be applied immediately by using `gpupdate /force`.
7575
7676 ### Domain controllers
7777
78 −Domain controllers evaluate the server LDAP signing requirement to determine whether to accept unsigned LDAP binds. This setting is typically configured through the Default Domain Controllers Policy.
78 +Domain controllers check the server LDAP signing requirement to decide if they accept unsigned LDAP binds. You usually set this requirement through the Default Domain Controllers Policy.
7979
80 −To configure LDAP signing on domain controllers:
80 +To set up LDAP signing on domain controllers:
8181
8282 1. Open **Microsoft Management Console** by selecting **Start** > **Run**, typing **mmc.exe**, and selecting **OK**.
8383 1. Select **File** > **Add/Remove Snap-in**.
8484 1. Select **Group Policy Management Editor**, and then select **Add**.
8585 1. Select **Browse** next to Group Policy Object.
8686 1. In the **Browse for a Group Policy Object** dialog, select **Default Domain Controllers Policy** under your domain, and then select **OK**.
87 −1. Select **Finish**, then select **OK**.
88 −1. Navigate to **Default Domain Controllers Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
87 +1. Select **Finish**, and then select **OK**.
88 +1. Go to **Default Domain Controllers Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
8989 1. Right-click **Domain controller: LDAP server signing requirements**, and select **Properties**.
90 −1. Enable **Define this policy setting**, then select one of the following options:
90 +1. Turn on **Define this policy setting**, and choose one of the following options:
9191 - **None**: Domain controller accepts both signed and unsigned LDAP binds (not recommended)
9292 - **Require signing**: Domain controller rejects unsigned LDAP binds (recommended)
9393 1. Select **OK**.
9494 1. Select **Yes** in the confirmation dialog.
9595
96 −Group Policy will apply this setting during the next policy refresh cycle. To apply immediately, run `gpupdate /force` on your domain controllers. When set to **Require signing**, domain controllers will reject LDAP simple binds over non-SSL/TLS connections and SASL binds that don't request signing.
96 +Group Policy applies this setting during the next policy refresh cycle. To apply it immediately, run `gpupdate /force` on your domain controllers. When set to **Require signing**, domain controllers reject LDAP simple binds over non-SSL/TLS connections and SASL binds that don't request signing.
9797
9898 ## Configure LDAP signing for Active Directory Lightweight Directory Services
9999
100 −For Active Directory Lightweight Directory Services (AD LDS) instances, LDAP signing is configured through a registry setting rather than Group Policy. This allows you to configure signing requirements independently for each AD LDS instance.
100 +For Active Directory Lightweight Directory Services (AD LDS) instances, configure LDAP signing through a registry setting instead of Group Policy. By using this method, you can set signing requirements independently for each AD LDS instance.
101101
102102 To configure LDAP signing for an AD LDS instance:
103103
104104 1. Open **Registry Editor** on the server hosting the AD LDS instance.
105 −1. Navigate to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<InstanceName>\Parameters`.
105 +1. Go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<InstanceName>\Parameters`.
106106 1. Create a new **DWORD (32-bit) Value** named **LDAPServerIntegrity**.
107107 1. Set the value to **2** to enable signing requirements.
108 −1. Close Registry Editor.
108 +1. Close **Registry Editor**.
109109
110 −The setting takes effect immediately without requiring a restart. The LDAPServerIntegrity value accepts the following values:
110 +The setting takes effect immediately without needing a restart. The **LDAPServerIntegrity** value accepts the following values:
111111
112112 - **0**: Signing is disabled (default)
113113 - **2**: Signing is required
114114
115115 ## Verify LDAP signing configuration
116116
117 −After configuring LDAP signing requirements, you should verify that the configuration is working as expected. You can test this by attempting an unsigned LDAP bind, which should be rejected if signing is properly configured.
117 +After you configure LDAP signing requirements, verify that the configuration works as expected. You can test this verification by attempting an unsigned LDAP bind. If signing is properly configured, the domain controller rejects the bind.
118118
119119 To verify LDAP signing is enforced:
120120
121121 1. On a computer with AD DS Admin Tools installed, open **LDP.exe** by selecting **Start** > **Run**, typing **ldp.exe**, and selecting **OK**.
122122 1. Select **Connection** > **Connect**.
123 −1. Type your domain controller name in **Server** and **389** in **Port**, then select **OK**.
123 +1. Type your domain controller name in **Server** and **389** in **Port**, and then select **OK**.
124124 1. After the connection is established, select **Connection** > **Bind**.
125125 1. Under **Bind type**, select **Simple bind**.
126126 1. Enter credentials and select **OK**.
127127
128 −If LDAP signing is properly enforced, you should receive an error message: "Ldap_simple_bind_s() failed: Strong Authentication Required." This confirms that the domain controller is rejecting unsigned LDAP binds.
128 +If LDAP signing is properly enforced, you receive an error message: "Ldap_simple_bind_s() failed: Strong Authentication Required." This error confirms that the domain controller rejects unsigned LDAP binds.
129129
130 −For production validation, monitor Event Viewer for Event ID 2888, which logs a summary every 24 hours showing how many unsigned bind attempts were rejected.
130 +For production validation, monitor Event Viewer for Event ID 2888. This event logs a summary every 24 hours showing how many unsigned binds attempts the domain controller rejected.

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.