Windows Server  ·  high  ·  Active Directory deep faults

LDAP channel binding and signing enforcement breaks applications

Domain controllers now reject unsigned simple LDAP binds. Applications that were never updated stop authenticating.

What you see

An application, appliance or printer that authenticates against Active Directory suddenly cannot, usually after a controller update or a hardening change.

What is actually wrong

Simple LDAP binds over an unencrypted connection are refused. The application is binding on port 389 without TLS and without signing.

Codes and articles

Event 2889Event 3039Event 3040LdapEnforceChannelBindingstrong authentication is requiredError 8232

Fixes (2)

Find every unsigned bind before enforcing anything
Elevated PowerShell on each domain controller1 week of logginglow riskreversible

Before enabling enforcement. This is the step that prevents the outage.

  1. Turn on the diagnostic logging that records unsigned binds.

    PowerShell
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics' -Name '16 LDAP Interface Events' -Value 2 -Type DWord

    Event 2889 records the client address and the account for every unsigned bind. Left running for a week it produces the complete list of what will break — which is the only way to do this without an outage.

  2. Collect the events after several days, covering month-end and any weekly jobs.

    PowerShell
    Get-WinEvent -LogName 'Directory Service' -MaxEvents 2000 |  Where-Object Id -eq 2889 |  ForEach-Object { ($_.Message -split "`n" | Select-String 'Client IP|Identity') -join ' ' } |  Group-Object | Sort-Object Count -Descending | Format-Table Count,Name -AutoSize

  3. Work through the list: multifunction printers, monitoring systems, backup appliances and older line-of-business applications are the usual occupants.

  4. Reconfigure each to use LDAPS on port 636, or LDAP with sign and seal. Most support it and simply were not configured for it.

  5. Only when the 2889 events have stopped, enable enforcement.

    PowerShell
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name LdapEnforceChannelBinding -Value 2 -Type DWordSet-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name 'LDAPServerIntegrity' -Value 2 -Type DWord
Confirm it workedNo 2889 events for a full week, then enforcement enabled with no support calls.
If you need to undo itSet the diagnostic value back to 0 to stop the logging.
Restore service, then fix the client properly
Elevated PowerShell60 minuteshigh riskreversible

Enforcement is already on and something is broken.

  1. Identify what is failing, from the controller's own log.

    PowerShell
    Get-WinEvent -LogName 'Directory Service' -MaxEvents 200 | Where-Object Id -in 2889,3039,3040 | Format-List TimeCreated,Id,Message

  2. Fix the client first if you can — configure it for LDAPS on 636. That is the permanent answer and it is often a single setting.

    PowerShell
    Test-NetConnection dc01.example.local -Port 636 -InformationLevel Detailed

  3. Confirm the controller has a certificate suitable for LDAPS, or the client cannot switch even when configured to.

    PowerShell
    Get-ChildItem Cert:\LocalMachine\My | Where-Object { $_.EnhancedKeyUsageList.FriendlyName -contains 'Server Authentication' } | Format-Table Subject,NotAfter,Thumbprint

  4. Only if a critical system cannot be fixed immediately, relax enforcement temporarily and schedule the real fix.

    PowerShell
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name LdapEnforceChannelBinding -Value 1 -Type DWordRestart-Service NTDS -Force

    Value 1 is "when supported", which lets older clients through. It is a genuine reduction in protection against relay attacks, so it belongs on a dated ticket rather than in the permanent configuration.

  5. Restore enforcement once the clients are fixed.

    PowerShell
    Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' -Name LdapEnforceChannelBinding -Value 2 -Type DWord
Confirm it workedThe application authenticates over LDAPS and enforcement is back at 2.
PowerShell
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters' | Format-List LdapEnforceChannelBinding,LDAPServerIntegrity
If you need to undo itThe value can be set back to 1 or 0 while clients are remediated.

Where this stops. This write-up was written and checked by hand. It says what each step changes, how to confirm it worked and how to reverse it, and anything destructive is flagged before you reach it. If it does not match what your machine is doing, search the Support Centre for the exact code or message — and when something needs a person, get in touch.