Updated LDAP signing articles with editorial changes

Author: robinharwood

WindowsServerDocs/identity/ad-ds/configure-ldap-signing-certificates.md

@@ -5,7 +5,7 @@ author: robinharwood
 ms.author: roharwoo
 ms.service: windows-server
 ms.topic: how-to
-ms.date: 12/18/2025
+ms.date: 01/15/2026
 ai-usage: ai-assisted
 #CustomerIntent: As a domain administrator, I want to configure LDAP over SSL certificates so that LDAP communications with my domain controllers are encrypted and secure.
 ---

WindowsServerDocs/identity/ad-ds/ldap-signing.md

@@ -3,7 +3,7 @@ title: LDAP signing for Active Directory Domain Services on Windows Server
 description: Understand the role of LDAP signing and channel binding in verifying data integrity and preventing session hijacking in Active Directory.
 #customer intent: As an IT admin, I want to understand how to enable LDAP signing so that I can secure LDAP communications in my Active Directory environment.
 ms.topic: concept-article
-ms.date: 12/18/2025
+ms.date: 01/15/2026
 author: robinharwood
 ms.author: roharwoo
 ms.reviewer: roharwoo
@@ -47,17 +47,7 @@ When you enable channel binding:
 
 ## Default security behavior
 
-The default LDAP security settings vary depending on your Windows Server version and deployment type.
-
-### Windows Server 2019 and earlier
-
-In Windows Server 2019 and earlier, LDAP security features are available but not enforced by default:
-
-- **LDAP signing**: Optional by default; domain controllers accept both signed and unsigned LDAP binds.
-- **LDAP channel binding**: Set to "Never" by default; domain controllers don't require Channel Binding Tokens.
-- **Client behavior**: Windows clients prefer encrypted connections but fall back to unencrypted if necessary.
-
-This permissive default allows compatibility with legacy applications and devices but requires administrators to manually enable security features to protect against man-in-the-middle attacks and session hijacking.
+The default LDAP security settings vary depending on your Windows Server version and deployment type. You can configure LDAP signing and channel binding through Group Policy settings on domain controllers and client computers. For more information about managing these policies, see [Manage LDAP signing using Group Policy](../manage-ldap-signing-group-policy.md).
 
 ### Windows Server 2025 and later
 
@@ -70,6 +60,16 @@ Windows Server 2025 and later significantly strengthens the default security pos
 
 These enhanced defaults protect new environments immediately upon deployment and are compatible with clients that support modern security features.
 
+### Windows Server 2019 and earlier
+
+In Windows Server 2019 and earlier, LDAP security features are available but not enforced by default:
+
+- **LDAP signing**: Optional by default; domain controllers accept both signed and unsigned LDAP binds.
+- **LDAP channel binding**: Set to "Never" by default; domain controllers don't require Channel Binding Tokens.
+- **Client behavior**: Windows clients prefer encrypted connections but fall back to unencrypted if necessary.
+
+This permissive default allows compatibility with legacy applications and devices but requires administrators to manually enable security features to protect against man-in-the-middle attacks and session hijacking.
+
 ### Upgrade considerations
 
 When you upgrade from earlier Windows Server versions to Windows Server 2025:
@@ -78,41 +78,7 @@ When you upgrade from earlier Windows Server versions to Windows Server 2025:
 - **Gradual enforcement recommended**: Evaluate client compatibility by using event monitoring before enabling signing or channel binding requirements.
 - **Migration path**: Start with "When supported" for channel binding and "Negotiate signing" for signing, then move to full enforcement after validating compatibility.
 
-For more information about the evolution of these requirements and specific deployment timelines, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
-
-## Group policy settings
-
-You can configure LDAP signing and channel binding through Group Policy settings on domain controllers and client computers.
-
-### LDAP signing policies
-
-**Domain controller policy:**
-
-- **Path**: Default Domain Controller Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
-- **Setting**: Domain controller: LDAP server signing requirements
-- **Options**:
-  - **None**: Doesn't require signing (vulnerable to attacks)
-  - **Require signing**: Rejects unsigned LDAP binds
-
-**Client policy:**
-
-- **Path**: Local Computer Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
-- **Setting**: Network security: LDAP client signing requirements
-- **Options**:
-  - **None**: Client doesn't request signing
-  - **Negotiate signing**: Client requests signing if server supports it
-  - **Require signing**: Client requires signing for all LDAP traffic
-
-### LDAP channel binding policy
-
-**Domain controller policy:**
-
-- **Path**: Default Domain Controller Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies > Security Options
-- **Setting**: Domain controller: LDAP server channel binding token requirements
-- **Options**:
-  - **Never**: Doesn't require channel binding
-  - **When supported**: Accepts channel binding when clients provide it
-  - **Always**: Requires channel binding for all connections
+For more information about the history of LDAP signing and channel binding policy changes in Windows, see [2020, 2023, and 2024 LDAP channel binding and LDAP signing requirements for Windows](https://support.microsoft.com/topic/2020-2023-and-2024-ldap-channel-binding-and-ldap-signing-requirements-for-windows-kb4520412-ef185fb8-00f7-167d-744c-f299a66fc00a).
 
 ## Event monitoring
 

WindowsServerDocs/identity/manage-ldap-signing-group-policy.md

@@ -75,7 +75,35 @@ After you configure this setting, client computers request LDAP signing based on
 
 ### Domain controllers
 
-Domain controllers check the server LDAP signing requirement to decide if they accept unsigned LDAP binds. You usually set this requirement through the Default Domain Controllers Policy.
+Domain controllers check the server LDAP signing requirement to decide if they accept unsigned LDAP binds. You usually set this requirement through the Default Domain Controllers Policy. Select the operating system version that matches your domain controllers to see the appropriate configuration steps.
+
+#### [Windows Server 2025](#tab/windows-server-2025)
+
+Starting with Windows Server 2025, all new Active Directory deployments require LDAP signing by default. This default is configured through the **Domain controller: LDAP server signing requirements enforcement** Group Policy setting, which is separate from the **Domain controller: LDAP server signing requirements** policy.
+
+The **Domain controller: LDAP server signing requirements enforcement** policy takes precedence over and overrides the **Domain controller: LDAP server signing requirements** policy. When both policies are configured, the enforcement policy setting is applied. This configuration ensures that new deployments automatically have stronger security defaults while allowing administrators to explicitly modify the behavior if needed.
+
+To configure LDAP signing enforcement on Windows Server 2025:
+
+1. Open **Microsoft Management Console** by selecting **Start** > **Run**, typing **mmc.exe**, and selecting **OK**.
+1. Select **File** > **Add/Remove Snap-in**.
+1. Select **Group Policy Management Editor**, and then select **Add**.
+1. Select **Browse** next to Group Policy Object.
+1. In the **Browse for a Group Policy Object** dialog, select **Default Domain Controllers Policy** under your domain, and then select **OK**.
+1. Select **Finish**, and then select **OK**.
+1. Go to **Default Domain Controllers Policy** > **Computer Configuration** > **Policies** > **Windows Settings** > **Security Settings** > **Local Policies** > **Security Options**.
+1. Right-click **Domain controller: LDAP server signing requirements enforcement**, and select **Properties**.
+1. Turn on **Define this policy setting**, and choose one of the following options:
+   - **Default:** Not Configured which has the same effect as Enabled (default for new deployments).
+   - **Enabled:** LDAP signing will be enforced regardless of what is set in the LDAP signing policy.
+   - **Disabled:** The setting from the LDAP Signing Policy will be used.
+1. Select **OK**.
+1. Select **Yes** in the confirmation dialog.
+
+> [!IMPORTANT]
+> If you're upgrading from an earlier version of Windows Server to Windows Server 2025, existing LDAP signing policies are preserved to prevent disruption. Review your current policy settings and update them as appropriate for your security requirements.
+
+#### [Windows Server 2022 and earlier](#tab/windows-server-2022)
 
 To set up LDAP signing on domain controllers:
 
@@ -93,6 +121,8 @@ To set up LDAP signing on domain controllers:
 1. Select **OK**.
 1. Select **Yes** in the confirmation dialog.
 
+---
+
 Group Policy applies this setting during the next policy refresh cycle. To apply it immediately, run `gpupdate /force` on your domain controllers. When set to **Require signing**, domain controllers reject LDAP simple binds over non-SSL/TLS connections and SASL binds that don't request signing.
 
 ## Configure LDAP signing for Active Directory Lightweight Directory Services