Skip to content

Commit 6e198d0

Browse files
robinharwoodrobinharwood
committed
Draft of ldap-signing.md
1 parent 0c06a90 commit 6e198d0

1 file changed

Lines changed: 156 additions & 0 deletions

File tree

‎WindowsServerDocs/identity/ad-ds/ldap-signing.md‎

Lines changed: 156 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,156 @@
1+
---
2+
title: LDAP signing for Active Directory Domain Services on Windows Server
3+
description: Understand the role of LDAP signing and channel binding in verifying data integrity and preventing session hijacking in Active Directory.
4+
#customer intent: As an IT admin, I want to understand how to enable LDAP signing so that I can secure LDAP communications in my Active Directory environment.
5+
ms.topic: concept-article
6+
ms.date: 12/16/2025
7+
author: robinharwood
8+
ms.author: roharwoo
9+
ms.reviewer: roharwoo
10+
---
11+
12+
# LDAP signing for Active Directory Domain Services
13+
14+
_LDAP signing_ is a security feature that cryptographically signs Lightweight Directory Access Protocol (LDAP) communications to verify data authenticity and integrity in Active Directory Domain Services (AD DS). _LDAP channel binding_ uses Channel Binding Tokens (CBT) to bind application-layer security with the underlying SSL/TLS session, preventing session hijacking and man-in-the-middle attacks. Together, these features protect LDAP traffic in AD DS environments from tampering, replay attacks, and unauthorized access.
15+
16+
LDAP is widely used to authenticate users and retrieve directory information in AD DS. Without proper security measures, LDAP communications are vulnerable to attacks where intruders intercept authentication attempts, modify packets in transit, or hijack encrypted sessions. LDAP signing and channel binding provide essential protection layers that ensure both clients and servers can trust the authenticity and integrity of their communications.
17+
18+
This article explains how LDAP signing and channel binding work, describes the security improvements Microsoft has introduced over time, and highlights new features in Windows Server 2025.
19+
20+
## How LDAP signing works
21+
22+
LDAP signing digitally signs LDAP messages to ensure that data hasn't been tampered with during transmission. When you enable LDAP signing, both the client and server cryptographically sign their communications. Any unsigned or improperly signed requests are rejected, preventing unauthorized modifications to LDAP messages.
23+
24+
The signing process uses Simple Authentication and Security Layer (SASL) protocols, which include Negotiate, Kerberos, NTLM, and Digest protocols. When LDAP signing is enforced on a domain controller, it rejects SASL LDAP binds that don't request signing and rejects simple binds performed over non-encrypted connections.
25+
26+
Unsigned LDAP traffic is vulnerable to:
27+
28+
- **Replay attacks**: An intruder intercepts authentication attempts and tickets, then reuses them to impersonate legitimate users
29+
- **Man-in-the-middle attacks**: An attacker captures packets between client and server, modifies them, and forwards altered requests to the domain controller
30+
31+
By default, LDAP uses port 389. LDAP over SSL/TLS (LDAPS) uses port 636 and establishes encryption immediately upon connection.
32+
33+
## How LDAP channel binding works
34+
35+
LDAP channel binding uses Channel Binding Tokens (CBT) to cryptographically bind application-layer security (such as an SSL/TLS session) with the underlying network connection. This binding ensures that even if an attacker intercepts the encrypted session, they can't hijack or downgrade the connection.
36+
37+
Channel binding is particularly important when using NTLM or Simple Bind authentication over SSL/TLS. Without CBT enforcement, SSL/TLS encryption alone doesn't prevent all man-in-the-middle scenarios. An attacker positioned between client and server could potentially intercept the connection. By binding the security context directly to the SSL/TLS session, CBT ensures the session remains tamper-proof throughout its lifetime.
38+
39+
When channel binding is enabled:
40+
41+
1. The client establishes an SSL/TLS connection to the LDAP server
42+
2. A Channel Binding Token is generated based on the SSL/TLS session parameters
43+
3. The client includes this token when authenticating
44+
4. The server validates that the token matches the current SSL/TLS session
45+
5. If tokens mismatch or are missing when required, the connection is rejected
46+
47+
## Default security behavior
48+
49+
The default LDAP security settings vary depending on your Windows Server version and deployment type.
50+
51+
### Windows Server 2019 and earlier
52+
53+
In Windows Server versions prior to 2025, LDAP security features are available but not enforced by default:
54+
55+
- **LDAP signing**: Optional by default; domain controllers accept both signed and unsigned LDAP binds
56+
- **LDAP channel binding**: Set to "Never" by default; domain controllers don't require Channel Binding Tokens
57+
- **Client behavior**: Windows clients prefer encrypted connections but fall back to unencrypted if necessary
58+
59+
This permissive default allowed compatibility with legacy applications and devices but required administrators to manually enable security features to protect against man-in-the-middle attacks and session hijacking.
60+
61+
### Windows Server 2025 and later
62+
63+
Windows Server 2025 and later significantly strengthens default security posture for new deployments:
64+
65+
- **LDAP signing**: Mandatory by default for all new Active Directory deployments through the "Domain controller: LDAP server signing requirements enforcement" policy
66+
- **LDAP channel binding**: Set to "When supported" by default; domain controllers accept channel binding when clients provide it
67+
- **LDAP client encryption**: Preferred by default
68+
- **Channel binding auditing**: Enabled by default
69+
70+
These enhanced defaults protect new environments immediately upon deployment, compatible with clients that support modern security features.
71+
72+
### Upgrade considerations
73+
74+
When you upgrade from earlier Windows Server versions to Windows Server 2025:
75+
76+
- **Existing policies preserved**: Upgrade installations maintain their current LDAP security settings to prevent disruption
77+
- **Gradual enforcement recommended**: Evaluate client compatibility using event monitoring before enabling signing or channel binding requirements
78+
- **Migration path**: Start with "When supported" for channel binding and "Negotiate signing" for signing, then move to full enforcement after validating compatibility
79+
80+
To learn more about the evolution of these requirements and specific deployment timelines, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
81+
82+
## Group policy settings
83+
84+
You can configure LDAP signing and channel binding through Group Policy settings on domain controllers and client computers.
85+
86+
### LDAP signing policies
87+
88+
**Domain controller policy:**
89+
90+
- **Path**: Default Domain Controller Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
91+
- **Setting**: Domain controller: LDAP server signing requirements
92+
- **Options**:
93+
- **None**: Doesn't require signing (vulnerable to attacks)
94+
- **Require signing**: Rejects unsigned LDAP binds
95+
96+
**Client policy:**
97+
98+
- **Path**: Local Computer Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
99+
- **Setting**: Network security: LDAP client signing requirements
100+
- **Options**:
101+
- **None**: Client doesn't request signing
102+
- **Negotiate signing**: Client requests signing if server supports it
103+
- **Require signing**: Client requires signing for all LDAP traffic
104+
105+
### LDAP channel binding policy
106+
107+
**Domain controller policy:**
108+
109+
- **Path**: Default Domain Controller Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
110+
- **Setting**: Domain controller: LDAP server channel binding token requirements
111+
- **Options**:
112+
- **Never**: Doesn't require channel binding
113+
- **When supported**: Accepts channel binding when clients provide it
114+
- **Always**: Requires channel binding for all connections
115+
116+
## Event monitoring
117+
118+
LDAP signing and channel binding generate specific events that help you monitor security status and troubleshoot connectivity issues. These events appear in Event Viewer under the Directory Service category.
119+
120+
### LDAP signing events
121+
122+
| Event ID | Name | Description | Recommended action |
123+
|----------|------|-------------|-------------------|
124+
| 2886 | LDAP signing not required | Domain controller allows unsigned LDAP communications | Evaluate client compatibility and consider requiring signing |
125+
| 2887 | Unsigned LDAP binds detected | Client made unsigned simple bind or SASL bind without SSL/TLS | Investigate client; configure to use LDAPS or signed LDAP |
126+
| 2888 | LDAP signing disabled | Domain controller allows all unsigned traffic (highly vulnerable) | Immediately enable LDAP signing to protect environment |
127+
| 2889 | Signed LDAP communications | Domain controller successfully processed signed LDAP request | No action needed; indicates secure traffic |
128+
129+
### LDAP channel binding events
130+
131+
| Event ID | Name | Description | Recommended action |
132+
|----------|------|-------------|-------------------|
133+
| 3039 | Channel binding not supported | Client doesn't support CBT when policy requires it | Update client or temporarily adjust policy during migration |
134+
| 3040 | Channel binding failure | Client attempted CBT but binding failed (token mismatch) | Verify SSL/TLS certificates and network configuration |
135+
| 3041 | Channel binding successful | Client successfully used channel binding | No action needed; indicates secure communication |
136+
137+
### Event troubleshooting workflow
138+
139+
1. **Enable auditing**: Configure Advanced Audit Policy Configuration in Group Policy under Audit Directory Service Access
140+
2. **Monitor logs regularly**: Check Event Viewer > Directory Service for events 2886-2889 and 3039-3041
141+
3. **Identify problematic clients**: Investigate sources of Event 2887 or 3039; update client configurations to support signing and channel binding
142+
4. **Implement gradually**: Start with "Negotiate signing" and "When supported" policies, then move to full enforcement after verifying client compatibility
143+
5. **Use audit mode**: Deploy changes in audit-only mode first to identify incompatible clients before enforcing
144+
6. **Update legacy systems**: Upgrade or replace clients that can't support signing or channel binding; isolate them on separate network segments if necessary
145+
146+
## LDAP client performance counters
147+
148+
Windows Server 2025 and Windows 11 version 24H2 introduce LDAP client performance counters that provide detailed visibility into LDAP client operations. These counters monitor binds, connections, operations, requests, responses, and searches per process on the local client machine. Multiple processes can be assessed simultaneously, helping you identify performance bottlenecks, troubleshoot Active Directory performance issues, and optimize LDAP client behavior in production environments.
149+
150+
To learn more about LDAP client performance counters, see [Active Directory LDAP client performance counters](ldap-client-performance-counters.md).
151+
152+
## Related content
153+
154+
- [How to enable LDAP signing in Windows Server](/troubleshoot/windows-server/active-directory/enable-ldap-signing-in-windows-server)
155+
- [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a)
156+
- [Frequently asked questions about changes to Lightweight Directory Access Protocol](https://support.microsoft.com/topic/frequently-asked-questions-about-changes-to-lightweight-directory-access-protocol-41a40287-810a-e799-d067-f578fca055fc)

0 commit comments

Comments
 (0)