I am in the process of migrating my domain controllers to new IPs and since we have several applications that use LDAP for authentication, I must change the DC ip in the settings of those applications (JIRA , vmware , ...). my question is: is there a sol

Question

I am in the process of migrating my domain controllers to new IPs and since we have several applications that use LDAP for authentication, I must change the DC ip in the settings of those applications (JIRA , vmware , ...).

my question is: is there a solution to identify all the applications which use LDAP using a (script

Answer 1

For exactly this purpose I wrote a PowerShell script — Collecting NETSTAT.

It runs netstat in a loop and accumulates everything it sees into a hashtable, so instead of a single snapshot you end up with every client that connected during the collection window. Press Ctrl+C and it prints statistics per source IP, optionally resolved to hostnames.

Worth adding alongside the Event 2889 approach above: LDAP diagnostics logging only records unsigned and cleartext binds, so clients already using signed LDAP or LDAPS never appear there. Netstat sees every TCP session regardless of bind type, so the two methods complement each other — the event log tells you who is binding insecurely, netstat tells you everyone who is connected.

Because it works at the TCP level it isn't LDAP-specific: on the same run you also see LDAPS (636), Global Catalog (3268/3269), Kerberos, SMB and HTTP/S.

In practice: start it on the DC and leave it for several hours — ideally a few days, so overnight and weekly jobs are covered — then stop it and review the list. Nothing needs installing, which matters on a DC where you usually can't run a sniffer.

One caveat: it collects TCP only, so UDP traffic such as NTP and most DNS queries won't show up.

Answer 2

Hello,

Yes, you can use a PowerShell script to identify applications that use LDAP for authentication. Here's a basic approach to get you started:

Enable LDAP Diagnostics Logging: First, you need to enable LDAP diagnostics logging on your domain controllers. This can be done using Group Policy or PowerShell. Here's how to enable it using PowerShell:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics" -Name "16 LDAP Interface Events" -Value 2

Collect LDAP Logs: Once logging is enabled, you can collect the logs to identify which applications are making LDAP queries. Use the following PowerShell script to query the Event Log for LDAP connections:

$Hours = 24

$DCs = Get-ADDomainController -Filter *

$InsecureLDAPBinds = @()

 

foreach ($DC in $DCs) {

    $Events = Get-WinEvent -ComputerName $DC.HostName -LogName "Directory Service" -FilterHashtable @{Id=2889; StartTime=(Get-Date).AddHours(-$Hours)} | Select-Object -Property TimeCreated, Message

    $InsecureLDAPBinds += $Events

}

 

$InsecureLDAPBinds | Format-Table -AutoSize

This script will gather LDAP bind events from the Directory Service event log on all domain controllers for the past 24 hours. You can adjust the $Hours variable to change the time frame.

Analyze the Logs: Review the output to identify the source IP addresses or hostnames of the applications making LDAP queries. This will help you pinpoint which applications need their settings updated.