Windows Server  ·  high  ·  Active Directory deep faults

LDAP channel binding and signing enforcement breaks applications

Domain controllers now reject unsigned simple LDAP binds. Applications that were never updated stop authenticating.

What you see

An application, appliance or printer that authenticates against Active Directory suddenly cannot, usually after a controller update or a hardening change.

What is actually wrong

Simple LDAP binds over an unencrypted connection are refused. The application is binding on port 389 without TLS and without signing.

Codes and articles

Event 2889Event 3039Event 3040LdapEnforceChannelBindingstrong authentication is requiredError 8232

Start here — find out which fix applies

A script that runs the 1 inspection command from the write-up below and prints what each one returned. It reads the machine and changes nothing — every command that could write, delete, start or stop is excluded from it by construction. Run this first, then pick the fix its output points at.

Download the read-only diagnosticchanges nothing · safe to run before reading

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Fixes (2)

Find every unsigned bind before enforcing anything
Elevated PowerShell on each domain controller1 week of logginglow riskreversible

Before enabling enforcement. This is the step that prevents the outage.

  1. Turn on the diagnostic logging that records unsigned binds.

    PowerShell
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics' -Name '16 LDAP Interface Events' -Value 2 -Type DWord

    Event 2889 records the client address and the account for every unsigned bind. Left running for a week it produces the complete list of what will break — which is the only way to do this without an outage.

  2. Collect the events after several days, covering month-end and any weekly jobs.

    PowerShell
    Get-WinEvent -LogName 'Directory Service' -MaxEvents 2000 |  Where-Object Id -eq 2889 |  ForEach-Object { ($_.Message -split "`n" | Select-String 'Client IP|Identity') -join ' ' } |  Group-Object | Sort-Object Count -Descending | Format-Table Count,Name -AutoSize

  3. Work through the list: multifunction printers, monitoring systems, backup appliances and older line-of-business applications are the usual occupants.

  4. Reconfigure each to use LDAPS on port 636, or LDAP with sign and seal. Most support it and simply were not configured for it.

  5. Only when the 2889 events have stopped, enable enforcement.

    PowerShell
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name LdapEnforceChannelBinding -Value 2 -Type DWordSet-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name 'LDAPServerIntegrity' -Value 2 -Type DWord
Confirm it workedNo 2889 events for a full week, then enforcement enabled with no support calls.
If you need to undo itSet the diagnostic value back to 0 to stop the logging.
Download this fix as a PowerShell script2 steps you do yourself · asks before each step

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Restore service, then fix the client properly
Elevated PowerShell60 minuteshigh riskreversible

Enforcement is already on and something is broken.

  1. Identify what is failing, from the controller's own log.

    PowerShell
    Get-WinEvent -LogName 'Directory Service' -MaxEvents 200 | Where-Object Id -in 2889,3039,3040 | Format-List TimeCreated,Id,Message

  2. Fix the client first if you can — configure it for LDAPS on 636. That is the permanent answer and it is often a single setting.

    PowerShell
    Test-NetConnection dc01.example.local -Port 636 -InformationLevel Detailed

  3. Confirm the controller has a certificate suitable for LDAPS, or the client cannot switch even when configured to.

    PowerShell
    Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains 'Server Authentication' } | Format-Table Subject,NotAfter,Thumbprint

  4. Only if a critical system cannot be fixed immediately, relax enforcement temporarily and schedule the real fix.

    PowerShell
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name LdapEnforceChannelBinding -Value 1 -Type DWordRestart-Service NTDS -Force

    Value 1 is "when supported", which lets older clients through. It is a genuine reduction in protection against relay attacks, so it belongs on a dated ticket rather than in the permanent configuration.

  5. Restore enforcement once the clients are fixed.

    PowerShell
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name LdapEnforceChannelBinding -Value 2 -Type DWord
Confirm it workedThe application authenticates over LDAPS and enforcement is back at 2.
PowerShell
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' | Format-List LdapEnforceChannelBinding,LDAPServerIntegrity
If you need to undo itThe value can be set back to 1 or 0 while clients are remediated.
Download this fix as a PowerShell scriptasks before each step

No warranty. Use at your own risk - JbTecWiz accepts no liability. Read it before you run it, and have a backup.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.