LDAP server signing requirements and SASL GSS-SPNEGO on port 389

Question

Hi Folks

I plan to change LDAP server signing requirements to Require signing but in the network I Can see a lot of LDAP connections base on SASL GSS-SPNEGO on port 389.

Please let me know if connections base on SASL will be blocked after policy change or not ?

I enabled LDAP logging and remediated all applications generating Event logs ID like: 2887,2888,2889

Thanks

Answer 1

Hi,

Please let me know if connections base on SASL will be blocked after policy change or not ?

The answer is yes. After enabling LDAP signing on domain controller , all LDAP request/connection will be rejected by domain controller.
I invite you to read the following article talking about LDAP signing:

Microsoft article about LDAP Signing

Please don't forget to mark helpful reply as answer