ChangeIntelIT change radar
Public mode

No access to your tenant or devices. Every item links to its source. What this means

Some sources or documents need attention: 258/260 feeds/APIs · 416/439 docs · checked 22:55 UTC Customize Public modeDiscuss ChangeIntel on Discord

AD LDAP signing enforcement policies

This page's changes and edits · All guidance changes

Microsoft's edit ·

Improve LDAP signing/channel binding/encryption docs: version accuracy and client coverage (#7979)

Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit a3e1abf · +49 −43 lines · also on GitHub

11 ---
2 −title: Manage LDAP signing using Group Policy for Active Directory Domain Service
3 −description: Learn how to configure LDAP signing requirements on Windows Server domain controllers using Group Policy to enhance security and prevent unauthorized access.
2 +title: Configure LDAP Signing by Using Group Policy
3 +description: Learn how to configure LDAP signing requirements on Windows Server domain controllers by using Group Policy to enhance security and prevent unauthorized access.
44 author: robinharwood
55 ms.author: roharwoo
6 −ms.service: windows-server
76 ms.topic: how-to
8 −ms.date: 12/18/2025
7 +ms.date: 10/02/2026
98 ai-usage: ai-assisted
109 #CustomerIntent: As a domain administrator, I want to configure LDAP signing requirements on my domain controllers so that I can protect my Active Directory environment from replay and man-in-the-middle attacks.
1110 ---
1211
13 −# Manage LDAP signing using Group Policy for Active Directory Domain Service
12 +# Configure LDAP signing by using Group Policy for Active Directory Domain Services
1413
15 −Configuring your domain controllers to require LDAP signing significantly improves the security of your Active Directory environment by rejecting unsigned LDAP binds. This article shows you how to configure LDAP server signing requirements using Group Policy and how to identify clients that need to be updated before enforcing this security requirement.
14 +Configuring your domain controllers to require LDAP signing improves the security of your Active Directory environment by rejecting unsigned LDAP binds. This article shows you how to configure LDAP server signing requirements by using Group Policy and how to identify clients that you need to update before enforcing this security requirement.
1615
17 −Unsigned network traffic is susceptible to replay attacks where an intruder intercepts authentication attempts and reuses credentials to impersonate legitimate users. Additionally, unsigned traffic is vulnerable to man-in-the-middle attacks where attackers can modify LDAP requests in transit. Requiring LDAP signing provides integrity verification that prevents these attack vectors.
16 +Unsigned network traffic is susceptible to replay attacks where an intruder intercepts authentication attempts and reuses credentials to impersonate legitimate users. Also, unsigned traffic is vulnerable to man-in-the-middle attacks where attackers can modify LDAP requests in transit. Requiring LDAP signing verifies integrity and prevents these attack vectors.
1817
1918 > [!NOTE]
20 −> Windows Server 2025 and later versions enable LDAP signing by default for new Active Directory deployments. If you're upgrading from earlier versions, existing policies are preserved to prevent disruption. For more information about default security behavior and version differences, see [LDAP signing for Active Directory Domain Services](ad-ds/ldap-signing.md).
19 +> Windows Server 2025 or later requires LDAP signing by default for new Active Directory deployments. During an upgrade, Windows Server preserves existing signing policies to prevent disruption; if no LDAP server signing policy exists, Windows Server 2025 requires signing by default. For more information about default security behavior and version differences, see [LDAP signing for Active Directory Domain Services](ad-ds/ldap-signing.md).
2120
2221 ## Prerequisites
2322
24 −- An account with Domain administrator privileges or equivalent
23 +- An account with permission to edit the applicable Group Policy Objects and modify registry settings on the target server. Use just-in-time elevation if your organization grants these permissions through Domain Admins.
2524 - Access to a domain controller or a computer with Active Directory Domain Services (AD DS) Remote Server Administration Tools (RSAT) installed
2625 - Group Policy Management Console installed
2726
28 −## Identify clients using unsigned LDAP binds
27 +## Identify clients that use unsigned LDAP binds
2928
3029 Before you require LDAP signing, identify which clients in your environment are currently making unsigned LDAP binds. Active Directory logs summary events to help you discover these clients without disrupting service.
3130
32 −By default, domain controllers log Event ID 2887 once every 24 hours when unsigned binds occur. This event provides summary information about the number of unsigned simple binds and unsigned SASL binds detected.
31 +On domain controllers that permit unsigned binds, `Event ID 2887` logs a 24-hour summary when unsigned binds occur. On domain controllers that require signing, `Event ID 2888` summarizes rejected unsigned binds.
3332
3433 To get detailed information about specific clients making unsigned binds:
3534
3635 1. Open **Event Viewer** on the domain controller.
3736 1. Go to **Applications and Services Logs** > **Directory Service**.
38 −1. Look for Event ID 2887 to see summary information about unsigned binds.
37 +1. In the event list, locate `Event ID 2887` for summary information about unsigned binds.
3938
4039 To enable detailed logging that identifies specific client IP addresses:
4140
4241 1. Open **Registry Editor** on the domain controller.
4342 1. Go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics`.
4443 1. Set the **16 LDAP Interface Events** value to **2** (Basic logging).
45 −1. Monitor for Event ID 2889, which logs each unsigned bind attempt including the client IP address and identity.
44 +1. Monitor for `Event ID 2889`, which logs each unsigned bind attempt, including the client IP address and identity.
45 +1. After the investigation, set **16 LDAP Interface Events** back to **0** to disable detailed logging.
4646
4747 After you identify all clients that need updates, configure them to request LDAP signing before you enforce signing requirements on your domain controllers.
4848
⋯ 3 unchanged lines
5252
5353 ### Client computers
5454
55 −You need to configure client computers to request LDAP signing when they communicate with domain controllers. You can set this up by using local policy on individual computers or through a domain Group Policy Object for enterprise-wide deployment. To prevent service disruptions, configure clients before you enforce signing on domain controllers. You can verify client compliance by repeating the steps in the previous [Identify clients using unsigned LDAP binds](#identify-clients-using-unsigned-ldap-binds) section to check for unsigned bind attempts.
55 +Configure client computers to request LDAP signing when they communicate with domain controllers. Set up this configuration by using local policy on individual computers or through a domain Group Policy Object for enterprise-wide deployment. To prevent service disruptions, configure clients before you enforce signing on domain controllers. Verify client compliance by repeating the steps in the previous [Identify clients that use unsigned LDAP binds](#identify-clients-that-use-unsigned-ldap-binds) section to check for unsigned bind attempts.
5656
57 −To configure LDAP signing on client computers using Group Policy:
57 +> [!NOTE]
58 +> All currently supported versions of Windows client use LDAP signing by default as LDAP clients. Manually configure this setting to set a specific signing level or ensure that legacy systems comply with your security requirements.
5859
60 +To configure LDAP signing on client computers by using Group Policy:
61 +
5962 1. Open **Microsoft Management Console** by selecting **Start** > **Run**, typing **mmc.exe**, and selecting **OK**.
6063 1. Select **File** > **Add/Remove Snap-in**.
6164 1. Select **Group Policy Object Editor**, and then select **Add**.
⋯ 1 unchanged line
6366 1. Select **OK**, and then select **Finish**.
6467 1. Select **Close**, and then select **OK**.
6568 1. Navigate to **Default Domain Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
66 −1. Right-click **Network security: LDAP client signing requirements**, and select **Properties**.
69 +1. Open the context menu for **Network security: LDAP client signing requirements**, and then select **Properties**.
6770 1. Select one of the following options:
68 − - **None**: Client doesn't request signing (not recommended)
69 − - **Negotiate signing**: Client requests signing if server supports it (recommended for gradual deployment)
70 − - **Require signing**: Client requires signing for all LDAP traffic (recommended for maximum security)
71 + - **None**: The client doesn't request signing (not recommended)
72 + - **Negotiate signing**: The client requests signing if the server supports it (recommended for gradual deployment)
73 + - **Require signing**: The client requires signing for all LDAP traffic (recommended for maximum security)
7174 1. Select **OK**.
7275 1. Select **Yes** in the confirmation dialog.
7376
74 −After you configure this setting, client computers request LDAP signing based on the selected policy. The policy takes effect at the next Group Policy refresh or can be applied immediately by using `gpupdate /force`.
77 +After you configure this setting, client computers request LDAP signing based on the selected policy. The policy takes effect at the next Group Policy refresh. To apply it immediately, run [gpupdate](/windows-server/administration/windows-commands/gpupdate) with the `/force` option.
7578
7679 ### Domain controllers
7780
78 −Domain controllers check the server LDAP signing requirement to decide if they accept unsigned LDAP binds. You usually set this requirement through the Default Domain Controllers Policy. Select the operating system version that matches your domain controllers to see the appropriate configuration steps.
81 +Domain controllers check the server LDAP signing requirement to decide whether they accept unsigned LDAP binds. You usually set this requirement through the Default Domain Controllers Policy. Select the operating system version that matches your domain controllers to see the appropriate configuration steps.
7982
8083 #### [Windows Server 2025](#tab/windows-server-2025)
8184
82 −Starting with Windows Server 2025, all new Active Directory deployments require LDAP signing by default. This default is configured through the **Domain controller: LDAP server signing requirements enforcement** Group Policy setting, which is separate from the **Domain controller: LDAP server signing requirements** policy.
85 +New Active Directory deployments on Windows Server 2025 or later require LDAP signing by default. The **Domain controller: LDAP server signing requirements enforcement** Group Policy setting configures this default, which is separate from the **Domain controller: LDAP server signing requirements** policy.
8386
84 −The **Domain controller: LDAP server signing requirements enforcement** policy takes precedence over and overrides the **Domain controller: LDAP server signing requirements** policy. When both policies are configured, the enforcement policy setting is applied. This configuration ensures that new deployments automatically have stronger security defaults while allowing administrators to explicitly modify the behavior if needed.
87 +The **Domain controller: LDAP server signing requirements enforcement** policy takes precedence over the **Domain controller: LDAP server signing requirements** policy. When you configure both policies, the enforcement policy setting applies. This configuration ensures that new deployments automatically have stronger security defaults while allowing administrators to explicitly modify the behavior if needed.
8588
8689 To configure LDAP signing enforcement on Windows Server 2025:
8790
⋯ 4 unchanged lines
9295 1. In the **Browse for a Group Policy Object** dialog, select **Default Domain Controllers Policy** under your domain, and then select **OK**.
9396 1. Select **Finish**, and then select **OK**.
9497 1. Go to **Default Domain Controllers Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
95 −1. Right-click **Domain controller: LDAP server signing requirements enforcement**, and select **Properties**.
98 +1. Open the context menu for **Domain controller: LDAP server signing requirements enforcement**, and then select **Properties**.
9699 1. Turn on **Define this policy setting**, and choose one of the following options:
97 − - **Default:** Not Configured which has the same effect as Enabled (default for new deployments).
98 − - **Enabled:** LDAP signing will be enforced regardless of what is set in the LDAP signing policy.
99 − - **Disabled:** The setting from the LDAP Signing Policy will be used.
100 + - **Default:** **Not Configured**, which has the same effect as **Enabled** (default for new deployments).
101 + - **Enabled:** The enforcement policy requires LDAP signing regardless of the **Domain controller: LDAP server signing requirements** policy.
102 + - **Disabled:** The **Domain controller: LDAP server signing requirements** policy determines the LDAP signing requirement.
100103 1. Select **OK**.
101104 1. Select **Yes** in the confirmation dialog.
102105
103106 > [!IMPORTANT]
104 −> If you're upgrading from an earlier version of Windows Server to Windows Server 2025, existing LDAP signing policies are preserved to prevent disruption. Review your current policy settings and update them as appropriate for your security requirements.
107 +> If you're upgrading from an earlier version of Windows Server to Windows Server 2025, Windows Server preserves existing LDAP signing policies to prevent disruption. Review your current policy settings and update them as appropriate for your security requirements.
105108
106 −#### [Windows Server 2022 and earlier](#tab/windows-server-2022)
109 +#### [Windows Server 2022 or earlier](#tab/windows-server-2022)
107110
108111 To set up LDAP signing on domain controllers:
109112
⋯ 4 unchanged lines
114117 1. In the **Browse for a Group Policy Object** dialog, select **Default Domain Controllers Policy** under your domain, and then select **OK**.
115118 1. Select **Finish**, and then select **OK**.
116119 1. Go to **Default Domain Controllers Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
117 −1. Right-click **Domain controller: LDAP server signing requirements**, and select **Properties**.
120 +1. Open the context menu for **Domain controller: LDAP server signing requirements**, and then select **Properties**.
118121 1. Turn on **Define this policy setting**, and choose one of the following options:
119 − - **None**: Domain controller accepts both signed and unsigned LDAP binds (not recommended)
120 − - **Require signing**: Domain controller rejects unsigned LDAP binds (recommended)
122 + - **None**: A domain controller accepts both signed and unsigned LDAP binds (not recommended)
123 + - **Require signing**: A domain controller rejects unsigned LDAP binds (recommended)
121124 1. Select **OK**.
122125 1. Select **Yes** in the confirmation dialog.
123126
⋯ 3 unchanged lines
127130
128131 ## Configure LDAP signing for Active Directory Lightweight Directory Services
129132
130 −For Active Directory Lightweight Directory Services (AD LDS) instances, configure LDAP signing through a registry setting instead of Group Policy. By using this method, you can set signing requirements independently for each AD LDS instance.
133 +For Active Directory Lightweight Directory Services (AD LDS) instances, configure LDAP signing through a registry setting instead of Group Policy. Use this method to set signing requirements independently for each AD LDS instance.
131134
132135 To configure LDAP signing for an AD LDS instance:
133136
134137 1. Open **Registry Editor** on the server hosting the AD LDS instance.
135138 1. Go to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<InstanceName>\Parameters`.
136 −1. Create a new **DWORD (32-bit) Value** named **LDAPServerIntegrity**.
139 +1. Create a new **DWORD (32-bit) Value** named `LDAPServerIntegrity`.
137140 1. Set the value to **2** to enable signing requirements.
138141 1. Close **Registry Editor**.
139142
140 −The setting takes effect immediately without needing a restart. The **LDAPServerIntegrity** value accepts the following values:
143 +The setting takes effect immediately without a restart. The `LDAPServerIntegrity` value accepts the following values:
141144
142 −- **0**: Signing is disabled (default)
143 −- **2**: Signing is required
145 +- **0**: Disables signing (default).
146 +- **2**: Requires signing.
144147
145148 ## Verify LDAP signing configuration
146149
147 −After you configure LDAP signing requirements, verify that the configuration works as expected. You can test this verification by attempting an unsigned LDAP bind. If signing is properly configured, the domain controller rejects the bind.
150 +After you configure LDAP signing requirements, verify that the configuration works as expected. Test the configuration by attempting an unsigned LDAP bind. If the LDAP signing policy requires signing, the domain controller rejects the bind.
148151
149 −To verify LDAP signing is enforced:
152 +Verify LDAP signing enforcement:
150153
151 −1. On a computer with AD DS Admin Tools installed, open **LDP.exe** by selecting **Start** > **Run**, typing **ldp.exe**, and selecting **OK**.
154 +> [!WARNING]
155 +> This test sends simple-bind credentials without TLS. Run it only in an isolated lab, use a nonprivileged disposable test account, and never enter production credentials.
156 +
157 +1. On a computer with AD DS Admin Tools, open **LDP.exe** by selecting **Start** > **Run**, typing **ldp.exe**, and selecting **OK**.
152158 1. Select **Connection** > **Connect**.
153159 1. Type your domain controller name in **Server** and **389** in **Port**, and then select **OK**.
154 −1. After the connection is established, select **Connection** > **Bind**.
160 +1. After you connect, select **Connection** > **Bind**.
155161 1. Under **Bind type**, select **Simple bind**.
156162 1. Enter credentials and select **OK**.
157163
158 −If LDAP signing is properly enforced, you receive an error message: "Ldap_simple_bind_s() failed: Strong Authentication Required." This error confirms that the domain controller rejects unsigned LDAP binds.
164 +If the domain controller enforces the LDAP signing requirement, you receive an error message: "Ldap_simple_bind_s() failed: Strong Authentication Required." This error confirms that the domain controller rejects unsigned LDAP binds.
159165
160 −For production validation, monitor Event Viewer for Event ID 2888. This event logs a summary every 24 hours showing how many unsigned binds attempts the domain controller rejected.
166 +For production validation, monitor Event Viewer for Event ID `2888`. This event logs a summary every 24 hours showing how many unsigned bind attempts the domain controller rejected.

Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 9 Oct 22:05 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.

ChangeIntel

An IT change radar: releases, security, known issues, retirements, documentation changes, and service status from public sources. Every item links to supporting evidence; dates and statuses can change after they are read.

Sources read 20 Oct 22:55 UTC · 258 of 260 readable · 256 fully read · documentation 416/439 current

No accounts or analytics; your preferences stay in your browser. Information, not advice. ChangeIntel is an independent tool and is not affiliated with or endorsed by Microsoft, Apple, Google, Broadcom (VMware), Jamf, Oracle, Mozilla, or any other vendor it covers. Product names are trademarks of their owners. Built by Evotec.