How to enable LDAP signing in Windows Server & Client Machines

LDAP signature is an authentication method in Windows Server that can improve the security of a directory server. Once activated, it will reject any request that does not require a signature or if the request uses non-SSL / TLS encryption. In this article, we will explain how you can enable LDAP signing on Windows Server and client computers. LDAP stands for Lightweight Directory Access Protocol (LDAP).

How to enable LDAP signing on Windows computers

To ensure that the attacker does not use a spoofed LDAP client to modify the server configuration and data, it is essential to enable LDAP signing. It is also important to activate it on client machines.

1. Define server LDAP signature requirement
2. Define client LDAP signing requirement using local computer policy
3. Set the client LDAP signing requirement using the domain Group Policy object
4. Define client LDAP signing requirement using registry keys
5. How to check configuration changes
6. How to Find Customers Who Don’t Use the “Require Signature” Option

The last section helps you understand the customers who required signature is not activated on the computer. It is a useful tool for IT administrators to isolate these computers and enable security settings on computers.

1]Define server LDAP signature requirement

1. Open Microsoft Management Console (mmc.exe)
2. Select File> Add / Remove Snap-in> select Group Policy Object Editor, then select Add.
3. It will open the Group Policy Wizard. Click the Browse button and select Default domain policy instead of the local computer
4. Click the OK button, then click the Finish button and close it.
5. To select Default domain policy> Computer configuration> Windows settings> Security settings> Local policies, then select Security Options.
6. Right click Domain controller: LDAP server signing requirements, then select Properties.
7. In the Domain Controller Properties: LDAP Server Signing Requirements dialog box, enable Set this policy setting, select Require signature in the Define this policy setting list, then select OK.
8. Check the settings again and apply them.

2]Define client LDAP signing requirement using local computer policy

1. Open the Run prompt, type gpedit.msc and press the Enter key.
2. In the Group Policy Editor, go to Local Computer Policy> Computer Configuration> Policies> Windows Settings> Security Settings> Local Policies, then select Security options.
3. Right click on Network security: LDAP client signature requirements, then select Properties.
4. In the Network Security: LDAP Properties Client Signature Requirements dialog box, select Require signature from the list, then choose OK.
5. Confirm the changes and apply them.

3]Set the client’s LDAP signing requirement using a domain Group Policy object

1. Open Microsoft Management Console (mmc.exe)
2. To select File > Add / Remove Snap> to select Group Policy Object Editor, then select Add.
3. It will open the Group Policy Wizard. Click the Browse button and select Default domain policy instead of the local computer
4. Click the OK button, then click the Finish button and close it.
5. To select Default domain policy > Computer configuration > Windows settings > Security settings > Local policies, then select Security options.
6. in the Network Security: LDAP Client Signature Requirements Properties dialog box select Require signature from the list, then choose Okay.
7. Confirm the changes and apply the settings.

4]Define client LDAP signing requirement using registry keys

The first thing to do is to make a backup of your registry

• Open the Registry Editor
• Move towards HKEY_LOCAL_MACHINE SYSTEM CurrentControlSet Services Settings
• Right click on the right pane and create a new DWORD with the name LDAPServerIntegrity
• Leave it at its default value.

>: Name of the AD LDS instance that you want to modify.