Disable LDAP 389 and enforce LDAPS 636 in AD

Chong 866

Hi,

We already install the certificate, enable LDAP signing and channel bind in AD. How to configure client’s directory service settings point to the LDAPS port (usually 636)?

Thanks

1 answer

Thameur-BOURBITA 32,981 Reputation points

2024-03-11T14:54:23.47+00:00

Hi @Chong •

You can use group policy or registry key:

Fore more information please refer to the following link:

How to set the client LDAP signing requirement by using a domain Group Policy Object

Please don't forget to accept helpful answer
Please sign in to rate this answer.
Chong 866 Reputation points

2024-03-20T04:35:35.4766667+00:00

We configured the "Domain controller: LDAP server signing requirements" and "Network security: LDAP client signing requirements" "Require signing" in both Default Domain Controller Policy and Default Domain Policy already, But the client still using 389 port. Any idea?

Thameur-BOURBITA 32,981 Reputation points

2024-03-20T10:40:06.66+00:00

@Chong

It's normale behavior, the port 389 will continue used tby client to send a ping LDAP during the Dclocator process in order to identify the closest domain controller and domain join.

Please don't forget to accept helpful answer

Chong 866 Reputation points

2024-03-21T06:09:29.8366667+00:00

So the 389 port cannot block in the network?

But our case is only 389 traffic, no 636 traffic after applied the GPO

Thameur-BOURBITA 32,981 Reputation points

2024-03-21T07:48:06.3766667+00:00

@Chong •

So the 389 port cannot block in the network?

You should avoid blocking this port 389 because there are certain services which cannot communicate through port 636 and you will have problems such as joining a machine in the domain and dclocator process

Please don't forget to accept helpful asnwer

Chong 866 Reputation points

2024-03-21T09:30:22.19+00:00

If the port 389 cannot blocked, that means the LDAP cannot migrate to use LDAPS in AD, and the transmission still running on port 389 which is unencrypted?

Thameur-BOURBITA 32,981 Reputation points

2024-03-21T10:25:34.6266667+00:00

@Chong •

At the active directory level, it is not a question of LDAP migration to LDAPs, it is a question of forcing the applications to use only the secure LDAPS protocol except for certain functionalities necessary for Windows such as dclocator and the join in the AD. So Active directory should accept the both awaiting a update from microsoft to these windows functionalities to use LDAPS instead of LDAP

LDAP to LDAP migration is at the LDAP application and client level.

Please don't forget to accept helpful answer
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Disable LDAP 389 and enforce LDAPS 636 in AD

1 answer

Your answer