How to identify LDAPS authendication

Question

How to identify LDAPS authendication

Loganathan Samynathan 1

Hello,

Does someone help me to check "how to identify LDAPS authentication through event viewer or any other application".

We have filter port 636 option using "netstat" but using this we can check only active LDAPS connection but I need to check older or recently disconnection connection as well as.

Thanks,
Loganathan.

Anonymous

2021-02-16T06:47:05.31+00:00

Hi,

Just want to confirm the current situations.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,
Anonymous

2021-02-16T06:47:16.927+00:00

Hi,

Just want to confirm the current situations.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,

1 answer

Your answer

Anonymous

2021-02-16T06:47:05.31+00:00

Hi,

Just want to confirm the current situations.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,
Anonymous

2021-02-16T06:47:16.927+00:00

Hi,

Just want to confirm the current situations.
If there's anything you'd like to know, don't hesitate to ask.

Best Regards,

Answer 1

Anonymous

Hi,

ADInsight is an LDAP (Light-weight Directory Access Protocol) real-time monitoring tool aimed at troubleshooting Active Directory client applications.
https://learn.microsoft.com/en-us/sysinternals/downloads/adinsight

If you want to enable events for LDAP, we need to edit the registry .
Go to HKEY_LOCAL_MACHINE -> SYSTEM -> CurrentControlSet -> Services -> NTDS -> Diagnostics. Note: Set '15 Field Engineering' to '5'. This enables Expensive and Inefficient LDAP calls to be logged in Event Viewer.
For more information ,you can refer to:
How to monitor Active Directory LDAP logs
https://www.manageengine.com/products/active-directory-audit/how-to/how-to-monitor-active-directory-ldap-logs.html

This response contains a third-party link. We provide this link for easy reference. Microsoft cannot guarantee the validity of any information and content in this link.

Best Regards,

Loganathan Samynathan 1 Reputation point

2021-02-17T04:38:30.74+00:00

Hi,

Thanks for the update. We have already enabled LDAP related settings and events 2886-2889 are displaying in event viewer.
But my actual need, we are using LDAPS for Authenticating servers but this server is too old so we planned to upgrade the server to latest OS version.

So we need to know what are the servers are using LDAPS for authentication, so that we can change LDAPS server in client end and down the older version.

Thanks,
Loganathan.
Anonymous

2021-02-18T08:02:19.467+00:00

Hi,
Would you please tell more information about your domain environment and the LDAPS authentication?
Best Regards,

Share via

How to identify LDAPS authendication

1 answer

Your answer