AD LDAP signing enforcement policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit 7da5601 · +31 −1 lines · also on GitHub
⋯ 74 unchanged lines
7575
7676
### Domain controllers
7777
78
−Domain controllers check the server LDAP signing requirement to decide if they accept unsigned LDAP binds. You usually set this requirement through the Default Domain Controllers Policy.
78
+Domain controllers check the server LDAP signing requirement to decide if they accept unsigned LDAP binds. You usually set this requirement through the Default Domain Controllers Policy. Select the operating system version that matches your domain controllers to see the appropriate configuration steps.
7979
80
+#### [Windows Server 2025](#tab/windows-server-2025)
81
+
82
+Starting with Windows Server 2025, all new Active Directory deployments require LDAP signing by default. This default is configured through the **Domain controller: LDAP server signing requirements enforcement** Group Policy setting, which is separate from the **Domain controller: LDAP server signing requirements** policy.
83
+
84
+The **Domain controller: LDAP server signing requirements enforcement** policy takes precedence over and overrides the **Domain controller: LDAP server signing requirements** policy. When both policies are configured, the enforcement policy setting is applied. This configuration ensures that new deployments automatically have stronger security defaults while allowing administrators to explicitly modify the behavior if needed.
85
+
86
+To configure LDAP signing enforcement on Windows Server 2025:
87
+
88
+1. Open **Microsoft Management Console** by selecting **Start** > **Run**, typing **mmc.exe**, and selecting **OK**.
89
+1. Select **File** > **Add/Remove Snap-in**.
90
+1. Select **Group Policy Management Editor**, and then select **Add**.
91
+1. Select **Browse** next to Group Policy Object.
92
+1. In the **Browse for a Group Policy Object** dialog, select **Default Domain Controllers Policy** under your domain, and then select **OK**.
93
+1. Select **Finish**, and then select **OK**.
94
+1. Go to **Default Domain Controllers Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
95
+1. Right-click **Domain controller: LDAP server signing requirements enforcement**, and select **Properties**.
96
+1. Turn on **Define this policy setting**, and choose one of the following options:
97
+ - **Default:** Not Configured which has the same effect as Enabled (default for new deployments).
98
+ - **Enabled:** LDAP signing will be enforced regardless of what is set in the LDAP signing policy.
99
+ - **Disabled:** The setting from the LDAP Signing Policy will be used.
100
+1. Select **OK**.
101
+1. Select **Yes** in the confirmation dialog.
102
+
103
+> [!IMPORTANT]
104
+> If you're upgrading from an earlier version of Windows Server to Windows Server 2025, existing LDAP signing policies are preserved to prevent disruption. Review your current policy settings and update them as appropriate for your security requirements.
105
+
106
+#### [Windows Server 2022 and earlier](#tab/windows-server-2022)
107
+
80108
To set up LDAP signing on domain controllers:
81109
82110
1. Open **Microsoft Management Console** by selecting **Start** > **Run**, typing **mmc.exe**, and selecting **OK**.
⋯ 9 unchanged lines
92120
- **Require signing**: Domain controller rejects unsigned LDAP binds (recommended)
93121
1. Select **OK**.
94122
1. Select **Yes** in the confirmation dialog.
123
+
124
+---
95125
96126
Group Policy applies this setting during the next policy refresh cycle. To apply it immediately, run `gpupdate /force` on your domain controllers. When set to **Require signing**, domain controllers reject LDAP simple binds over non-SSL/TLS connections and SASL binds that don't request signing.
97127
⋯ 33 unchanged lines
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.