How to check LDAP and SLDAP request on domain controller

Question

Hi All,

I would like to check all LDAP and Secure LDAP request on specific domain controller.
any specific event id or do we need to enabled additional audit event.
can anyone guide me.

Answer 1

Hello @Gopi Ponnusamy ,

Thank you for posting here.

Whether you are looking for the Event ID 2886, 2887, 2889, 3039, 3040 and 3041? If so, you can refer to links below:

2020 LDAP channel binding and LDAP signing requirements for Windows
https://support.microsoft.com/en-us/topic/2020-ldap-channel-binding-and-ldap-signing-requirements-for-windows-ef185fb8-00f7-167d-744c-f299a66fc00a

How to enable LDAP signing in Windows Server
https://learn.microsoft.com/en-US/troubleshoot/windows-server/identity/enable-ldap-signing-in-windows-server

Use the LdapEnforceChannelBinding registry entry to make LDAP authentication over SSL/TLS more secure
https://support.microsoft.com/en-us/topic/use-the-ldapenforcechannelbinding-registry-entry-to-make-ldap-authentication-over-ssl-tls-more-secure-e9ecfa27-5e57-8519-6ba3-d2c06b21812e

LDAP Channel Binding and LDAP Signing Requirements - March 2020 update final release
https://techcommunity.microsoft.com/t5/core-infrastructure-and-security/ldap-channel-binding-and-ldap-signing-requirements-march-2020/ba-p/921536/page/3#comments

Hope the information above is helpful.

Should you have any question or concern, please feel free to let us know.

Best Regards,
Daisy Zhou

============================================

If the Answer is helpful, please click "Accept Answer" and upvote it.