Solved

LDAP Interface issue in Active Directory Domain Service

Posted on 2009-07-10
9
868 Views
Last Modified: 2013-12-24
How does one address to this warning:

Log Name:      Directory Service
Source:        Microsoft-Windows-ActiveDirectory_DomainService
Date:          7/10/2009 3:16:08 PM
Event ID:      2886
Task Category: LDAP Interface
Level:         Warning
Keywords:      Classic
User:          ANONYMOUS LOGON
Computer:      SERVER.domain.local
Description:
The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate,  Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that  are performed on a cleartext (non-SSL/TLS-encrypted) connection.  Even if no clients are using such binds, configuring the server to reject them will improve the security of this server.
 
Some clients may currently be relying on unsigned SASL binds or LDAP simple binds over a non-SSL/TLS connection, and will stop working if this configuration change is made.  To assist in identifying these clients, if such binds occur this  directory server will log a summary event once every 24 hours indicating how many such binds  occurred.  You are encouraged to configure those clients to not use such binds.  Once no such events are observed  for an extended period, it is recommended that you configure the server to reject such binds
0
Comment
Question by:rkkhandelwal54
  • 5
  • 4
9 Comments
 
LVL 31

Accepted Solution

by:
Henrik Johansson earned 100 total points
ID: 24831316
Change the following policy policy settings

Computer Configuration\Windows Settings\Security Settings\Local Policies\Security Options
 Domain Controller: LDAP Server signing requirements = require
 Network Security: LDAP Client signing requirements = negiotiate

If the server side is set to require, all clients nead to respond with atleast negotiate
0
 

Author Comment

by:rkkhandelwal54
ID: 24833374
Thanks for the post. It is my mistake that i did not mention that I cam getting this on my SBS 2008 which is a clean install. I believe that I shall have to change the settings in the Group Policy. I shall be grateful if the exact path is specified.
0
 
LVL 31

Assisted Solution

by:Henrik Johansson
Henrik Johansson earned 100 total points
ID: 24833855
The full path was posted with the policy settings indented under the path line, but GPO management of 2008 has an additional path level for separating Policies and Preferences.

Computer Configuration\Policies\Windows Settings\Security Settings\Local Policies\Security Options
    Domain Controller: LDAP Server signing requirements = require
    Network Security: LDAP Client signing requirements = negiotiate


0
 

Author Comment

by:rkkhandelwal54
ID: 24834299
Thanks for the post. The resolution provided by you is for Windows XP but the message is seen on the SBS 2008 as can be seen in the post:
Computer:      SERVER.domain.local
 
0
How your wiki can always stay up-to-date

Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
- Increase transparency
- Onboard new hires faster
- Access from mobile/offline

 
LVL 31

Expert Comment

by:Henrik Johansson
ID: 24834601
The 'Domain Controller: LDAP server signing requirement' is server side and nead to be set on the DCs.

The 'Network security: LDAP client signing requireement' is client side. The default value on XP and newer is negotiate and shouldn't nead to be modified.
0
 

Author Comment

by:rkkhandelwal54
ID: 24884795
The followiing link provided the solution which I was looking for:
How to enable LDAP signing in Windows Server 2008
http://support.microsoft.com/kb/935834
Thanks.
0
 
LVL 31

Expert Comment

by:Henrik Johansson
ID: 24887443
The necessary policy setting has been included in each of my posts, so I don't see why I don't get any points awarded.
It's ok for me if author want to include his post with the KB, but I still request points to be awarded.
0
 

Author Comment

by:rkkhandelwal54
ID: 24888390
The path you mentioned was not seen in the GP Management Console and on searching further the refrenced KB article was found. A detailed response would have been valuable for everyone.
0
 

Author Closing Comment

by:rkkhandelwal54
ID: 31602360
The settings provided by the Expert could not be found in the GP Management console and was obtained from the KB article. Expert should understand that everyone looking for a solution is not an expert and may be a novice too.
0

Featured Post

Highfive + Dolby Voice = No More Audio Complaints!

Poor audio quality is one of the top reasons people don’t use video conferencing. Get the crispest, clearest audio powered by Dolby Voice in every meeting. Highfive and Dolby Voice deliver the best video conferencing and audio experience for every meeting and every room.

Join & Write a Comment

Suggested Solutions

Title # Comments Views Activity
Best way to export and then import DHCP to a new server? 6 27
automatic login 1 11
active directory 3 21
IT Contract Fee 17 61
APEX (Application Express) is used to develop a web application from Oracle. SQL Workshop is one of the tools that comes with Oracle APEX to query or modify the database objects or to make any changes to the structure.
Restoring deleted objects in Active Directory has been a standard feature in Active Directory for many years, yet some admins may not know what is available.
Video by: Steve
Using examples as well as descriptions, step through each of the common simple join types, explaining differences in syntax, differences in expected outputs and showing how the queries run along with the actual outputs based upon a simple set of dem…
Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

707 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

15 Experts available now in Live!

Get 1:1 Help Now