abelrguezr LDAP Signing & Channel Binding Hardening
This skill guides you through hardening Active Directory against LDAP relay and MITM attacks using two server-side controls:
- LDAP Channel Binding (CBT) — ties LDAPS binds to the specific TLS tunnel, breaking relays across different channels
- LDAP Signing — forces integrity-protected LDAP messages, preventing tampering and most unsigned relays
When to use this skill
Use this skill when you need to:
- Harden Domain Controllers against LDAP relay attacks
- Configure LDAP signing requirements
- Enable LDAP channel binding
- Audit current LDAP security posture
- Plan a safe rollout of LDAP hardening
- Interpret Directory Service security events
Quick offensive check
Before hardening, understand the risk. Tools like netexec reveal server posture:
netexec ldap <dc> -u user -p pass
If you see (signing:None) and (channel binding:Never), Kerberos/NTLM relays to LDAP are viable. Attackers can use tools like KrbRelayUp to write msDS-AllowedToActOnBehalfOfOtherIdentity for RBCD and impersonate administrators.
LDAP Channel Binding (LDAPS only)
Requirements
- CVE-2017-8563 patch (2017) — adds Extended Protection for Authentication support
- KB4520412 (Server 2019/2022) — adds LDAPS CBT "what-if" telemetry
GPO Configuration (Domain Controllers)
Policy: Domain controller: LDAP server channel binding token requirements
| Setting | Effect |
|---|---|
Never (default) |
No CBT enforcement |
When Supported |
Audit mode: emits failures, does not block |
Always |
Enforce: rejects LDAPS binds without valid CBT |
Audit Events
Set When Supported to surface these events:
- Event 3074 — LDAPS bind would have failed CBT validation if enforced
- Event 3075 — LDAPS bind omitted CBT data and would be rejected if enforced
- Event 3039 — CBT failures on older builds
Note: Channel binding only works on LDAPS (port 636), not raw LDAP (port 389).
LDAP Signing
Client GPO
Policy: Network security: LDAP client signing requirements
- Default on modern Windows:
Negotiate signing - Recommended:
Require signing
Domain Controller GPO
Legacy policy (Server 2016-2022):
- Policy:
Domain controller: LDAP server signing requirements - Default:
None - Recommended:
Require signing
Server 2025 DCs (new behavior):
- Leave legacy policy at
None - Policy:
LDAP server signing requirements Enforcement - Default (Not Configured): Require Signing is enforced
- To avoid enforcement: explicitly set to
Disabled
Compatibility
Only Windows XP SP3+ supports LDAP signing. Older systems will break when enforcement is enabled.
Audit-first rollout (recommended ~30 days)
Follow this phased approach to avoid breaking legacy clients:
Phase 1: Enable diagnostics
On each Domain Controller, enable LDAP interface diagnostics to log unsigned binds:
Reg Add HKLM\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics /v "16 LDAP Interface Events" /t REG_DWORD /d 2
Phase 2: Start CBT telemetry
Set DC GPO LDAP server channel binding token requirements = When Supported
Phase 3: Monitor Directory Service events
Watch for these events in the Directory Service log:
| Event ID | Meaning |
|---|---|
| 2889 | Unsigned/unsigned-allowed binds (signing noncompliant) |
| 3074 | LDAPS binds that would fail CBT if enforced |
| 3075 | LDAPS binds that omit CBT and would be rejected |
Note: Events 3074/3075 require KB4520412 on Server 2019/2022 and Phase 2 above.
Phase 4: Enforce in separate changes
Apply these in sequence, monitoring for breakage between each:
LDAP server channel binding token requirements= Always (DCs)LDAP client signing requirements= Require signing (clients)LDAP server signing requirements= Require signing (DCs) or (Server 2025)LDAP server signing requirements Enforcement= Enabled
Common issues and troubleshooting
Legacy clients break after enabling signing
- Check Event 2889 for unsigned bind attempts
- Identify the source systems and either:
- Upgrade them to Windows XP SP3+
- Exclude them from the GPO using security filtering
- Create a separate OU with a GPO that doesn't enforce signing
LDAPS connections fail after enabling CBT
- Verify clients have CVE-2017-8563 patch
- Check Event 3074/3075 for CBT failures
- Ensure clients are using LDAPS (port 636), not LDAP (port 389)
- Some legacy applications may not support CBT — exclude them from enforcement
Server 2025 unexpected enforcement
- Server 2025 defaults to Require Signing when the new policy is Not Configured
- To disable: explicitly set
LDAP server signing requirements Enforcement=Disabled