AD LDAP signing enforcement policies
Microsoft's edit ·
Microsoft's commit message in MicrosoftDocs/windowsserverdocs · commit d35b395 · +130 −0 lines · also on GitHub
The file is new at this commit, or was moved here from another path: every line shows as added.
1
+---
2
+title: Manage LDAP signing using Group Policy
3
+description: Learn how to configure LDAP signing requirements on Windows Server domain controllers using Group Policy to enhance security and prevent unauthorized access.
4
+author: robinharwood
5
+ms.author: roharwoo
6
+ms.service: windows-server
7
+ms.topic: how-to
8
+ms.date: 12/17/2025
9
+
10
+#CustomerIntent: As a domain administrator, I want to configure LDAP signing requirements on my domain controllers so that I can protect my Active Directory environment from replay and man-in-the-middle attacks.
11
+---
12
+
13
+# Manage LDAP signing using Group Policy
14
+
15
+Configuring your domain controllers to require LDAP signing significantly improves the security of your Active Directory environment by rejecting unsigned LDAP binds. This article shows you how to configure LDAP server signing requirements using Group Policy and how to identify clients that need to be updated before enforcing this security requirement.
16
+
17
+Unsigned network traffic is susceptible to replay attacks where an intruder intercepts authentication attempts and reuses credentials to impersonate legitimate users. Additionally, unsigned traffic is vulnerable to man-in-the-middle attacks where attackers can modify LDAP requests in transit. Requiring LDAP signing provides integrity verification that prevents these attack vectors.
18
+
19
+> [!NOTE]
20
+> Windows Server 2025 and later versions enable LDAP signing by default for new Active Directory deployments. If you're upgrading from earlier versions, existing policies are preserved to prevent disruption. For more information about default security behavior and version differences, see [LDAP signing for Active Directory Domain Services](ad-ds/ldap-signing.md).
21
+
22
+## Prerequisites
23
+
24
+- An account with Domain administrator privileges or equivalent
25
+- Access to a domain controller or a computer with Active Directory Domain Services (AD DS) Remote Server Administration Tools (RSAT) installed
26
+- Group Policy Management Console installed
27
+
28
+## Identify clients using unsigned LDAP binds
29
+
30
+Before requiring LDAP signing, you should identify which clients in your environment are currently making unsigned LDAP binds. Active Directory logs summary events to help you discover these clients without disrupting service.
31
+
32
+By default, domain controllers log Event ID 2887 once every 24 hours when unsigned binds occur. This event provides summary information about the number of unsigned simple binds and unsigned SASL binds detected.
33
+
34
+To get detailed information about specific clients making unsigned binds:
35
+
36
+1. Open **Event Viewer** on the domain controller.
37
+1. Navigate to **Applications and Services Logs** > **Directory Service**.
38
+1. Look for Event ID 2887 to see summary information about unsigned binds.
39
+
40
+To enable detailed logging that identifies specific client IP addresses:
41
+
42
+1. Open **Registry Editor** on the domain controller.
43
+1. Navigate to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics`.
44
+1. Set the **16 LDAP Interface Events** value to **2** (Basic logging).
45
+1. Monitor for Event ID 2889, which logs each unsigned bind attempt including the client IP address and identity.
46
+
47
+After identifying all clients that require updates, configure them to request LDAP signing before proceeding to enforce signing requirements on your domain controllers.
48
+
49
+## Configure LDAP signing requirements
50
+
51
+Configure LDAP signing on both domain controllers and client computers to ensure secure LDAP communications across your environment.
52
+
53
+### Client computers
54
+
55
+Client computers need to be configured to request LDAP signing when communicating with domain controllers. This can be configured using local policy on individual computers or through a domain Group Policy Object for enterprise-wide deployment. We recommend configuring clients before enforcing signing on domain controllers to prevent service disruptions. You can verify client compliance by repeating the steps in the previous [Identify clients using unsigned LDAP binds](#identify-clients-using-unsigned-ldap-binds) section to check for unsigned bind attempts.
56
+
57
+To configure LDAP signing on client computers using Group Policy:
58
+
59
+1. Open **Microsoft Management Console** by selecting **Start** > **Run**, typing **mmc.exe**, and selecting **OK**.
60
+1. Select **File** > **Add/Remove Snap-in**.
61
+1. Select **Group Policy Object Editor**, then select **Add**.
62
+1. Select **Browse**, and then select **Default Domain Policy** or your preferred Group Policy Object.
63
+1. Select **OK**, then select **Finish**.
64
+1. Select **Close**, then select **OK**.
65
+1. Navigate to **Default Domain Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
66
+1. Right-click **Network security: LDAP client signing requirements**, and select **Properties**.
67
+1. Select one of the following options:
68
+ - **None**: Client doesn't request signing (not recommended)
69
+ - **Negotiate signing**: Client requests signing if server supports it (recommended for gradual deployment)
70
+ - **Require signing**: Client requires signing for all LDAP traffic (recommended for maximum security)
71
+1. Select **OK**.
72
+1. Select **Yes** in the confirmation dialog.
73
+
74
+After configuring this setting, client computers will request LDAP signing based on the selected policy. The policy takes effect at the next Group Policy refresh or can be applied immediately using `gpupdate /force`.
75
+
76
+### Domain controllers
77
+
78
+Domain controllers evaluate the server LDAP signing requirement to determine whether to accept unsigned LDAP binds. This setting is typically configured through the Default Domain Controllers Policy.
79
+
80
+To configure LDAP signing on domain controllers:
81
+
82
+1. Open **Microsoft Management Console** by selecting **Start** > **Run**, typing **mmc.exe**, and selecting **OK**.
83
+1. Select **File** > **Add/Remove Snap-in**.
84
+1. Select **Group Policy Management Editor**, and then select **Add**.
85
+1. Select **Browse** next to Group Policy Object.
86
+1. In the **Browse for a Group Policy Object** dialog, select **Default Domain Controllers Policy** under your domain, and then select **OK**.
87
+1. Select **Finish**, then select **OK**.
88
+1. Navigate to **Default Domain Controllers Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
89
+1. Right-click **Domain controller: LDAP server signing requirements**, and select **Properties**.
90
+1. Enable **Define this policy setting**, then select one of the following options:
91
+ - **None**: Domain controller accepts both signed and unsigned LDAP binds (not recommended)
92
+ - **Require signing**: Domain controller rejects unsigned LDAP binds (recommended)
93
+1. Select **OK**.
94
+1. Select **Yes** in the confirmation dialog.
95
+
96
+Group Policy will apply this setting during the next policy refresh cycle. To apply immediately, run `gpupdate /force` on your domain controllers. When set to **Require signing**, domain controllers will reject LDAP simple binds over non-SSL/TLS connections and SASL binds that don't request signing.
97
+
98
+## Configure LDAP signing for Active Directory Lightweight Directory Services
99
+
100
+For Active Directory Lightweight Directory Services (AD LDS) instances, LDAP signing is configured through a registry setting rather than Group Policy. This allows you to configure signing requirements independently for each AD LDS instance.
101
+
102
+To configure LDAP signing for an AD LDS instance:
103
+
104
+1. Open **Registry Editor** on the server hosting the AD LDS instance.
105
+1. Navigate to `HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\<InstanceName>\Parameters`.
106
+1. Create a new **DWORD (32-bit) Value** named **LDAPServerIntegrity**.
107
+1. Set the value to **2** to enable signing requirements.
108
+1. Close Registry Editor.
109
+
110
+The setting takes effect immediately without requiring a restart. The LDAPServerIntegrity value accepts the following values:
111
+
112
+- **0**: Signing is disabled (default)
113
+- **2**: Signing is required
114
+
115
+## Verify LDAP signing configuration
116
+
117
+After configuring LDAP signing requirements, you should verify that the configuration is working as expected. You can test this by attempting an unsigned LDAP bind, which should be rejected if signing is properly configured.
118
+
119
+To verify LDAP signing is enforced:
120
+
121
+1. On a computer with AD DS Admin Tools installed, open **LDP.exe** by selecting **Start** > **Run**, typing **ldp.exe**, and selecting **OK**.
122
+1. Select **Connection** > **Connect**.
123
+1. Type your domain controller name in **Server** and **389** in **Port**, then select **OK**.
124
+1. After the connection is established, select **Connection** > **Bind**.
125
+1. Under **Bind type**, select **Simple bind**.
126
+1. Enter credentials and select **OK**.
127
+
128
+If LDAP signing is properly enforced, you should receive an error message: "Ldap_simple_bind_s() failed: Strong Authentication Required." This confirms that the domain controller is rejecting unsigned LDAP binds.
129
+
130
+For production validation, monitor Event Viewer for Event ID 2888, which logs a summary every 24 hours showing how many unsigned bind attempts were rejected.
Microsoft's Markdown source from MicrosoftDocs/windowsserverdocs, © Microsoft Corporation, under CC BY 4.0. Changed lines with up to 3 unchanged lines around each; ChangeIntel kept this copy 10 Oct 18:27 UTC. The commit date is when the source changed, which can be hours or days before Learn published it.