The phase-out of NTLM and RC4 was just the beginning. With LDAP Signing and Channel Binding, Microsoft is driving forward the next phase of Active Directory hardening. Anyone still using unsigned LDAP should take action now, even though the exact enforcement strategy for existing environments is more nuanced than is often portrayed.
For IT administrators, this means specific action will be required in applications, VPN systems and network devices if the configuration is not updated in time.
What is LDAP and what is the problem?
LDAP (Lightweight Directory Access Protocol) is the protocol through which clients, applications and services communicate with Active Directory. Every user login, every Group Policy evaluation and every query for directory information runs in the background via LDAP.
The problem: By default, Active Directory on older versions of Windows Server permits unsigned LDAP over port 389 – that is, connections without cryptographic integrity checks. An attacker on the network can intercept these connections, manipulate them or exploit them for relay attacks.
Important: LDAP relay is one of the most common vulnerabilities found in Active Directory Pentests. It requires no administrator privileges and can be exploited in almost any unhardened environment.
An overview of the two security controls
LDAP Signing
LDAP Signing ensures that every LDAP message is accompanied by a digital signature. Without signing, an attacker can manipulate the communication between the client and the Domain Controller without being detected. With signing enabled, any manipulated message is rejected by the Domain Controller.
LDAP Channel Binding
Channel Binding goes one step further: it binds LDAP authentication to the underlying TLS channel. An attacker who intercepts and forwards an authentication request cannot reuse the stolen credentials on a different channel because the binding does not match.
In short: signing protects the integrity of the message. Channel Binding protects authentication against relaying. Together, these two measures completely close the attack vector.
Microsoft’s hardening strategy: What really applies
Important note: The following overview supersedes a simplified timeline (phases March / September 2026) circulating in other sources. These specific global enforcement deadlines for existing Domain Controllers are not covered by any official Microsoft documentation (KB4520412, Microsoft Learn). The actual strategy is more nuanced and depends on the version of Windows Server being used.
Windows Server 2025: LDAP Signing enforced by default
From Windows Server 2025 onwards, Microsoft will enforce LDAP Signing by default for newly deployed Domain Controllers via the new Group Policy Domain controller: LDAP server signing requirements Enforcement. This policy is set to ‘Not Configured’ by default, which effectively corresponds to ‘Require Signing’. When upgrading from an older version to WS2025, existing settings remain unchanged.
WS 2019 / 2022: Existing DCs without automatic enforcement
On existing Domain Controllers running versions prior to Windows Server 2025, Microsoft does not automatically change the LDAP settings via an update. The old default values remain in place: LDAP Signing is set to ‘Optional’, and Channel Binding to ‘Never’. Administrators must actively and manually change the configuration via Group Policy or the registry key LDAPServerIntegrity = 2 .
Channel Binding: No new default in WS2025 either
Channel Binding remains set to “Never” by default in Windows Server 2025. Unlike with LDAP Signing for new WS2025 DCs, Microsoft has not changed the default behaviour here. The configuration must be explicitly enabled by administrators.
If you see Event ID 2887 or 2889 on your Domain Controllers, you have active LDAP clients that can no longer establish a connection following manual or policy-based enforcement activation. Now is the right time to take action.
Relevant event IDs for auditing
LDAP Signing (all supported Windows Server versions)
-
2886: LDAP Signing is not enabled (DC service start-up warning) -
2887: Daily summary, number of unsigned binds -
2888: Client has requested signing, DC is not configured -
2889: Logs specific clients without signing (with IP/hostname)
Channel Binding (from WS 2019 / 2022 with KB4520412)
-
3039: Client has not provided a Channel Binding token -
3040: Daily summary, binds without CBT (if policy is set to ‘Never’) -
3041: Start-up warning: CBT policy is set to ‘Never’
New in Windows Server 2025
-
3074: Client Channel Binding error (identifies non-compliant devices) -
3075: Channel Binding policy has been changed to a more restrictive level
Specific implications
Applications with LDAP connectivity
Any software that authenticates users against Active Directory uses LDAP in the background. Typically affected are VPN gateways and firewalls with AD authentication (Cisco, Fortinet, Palo Alto), web applications with LDAP binding (Confluence, Jira, GitLab, OTRS), monitoring systems and SIEM solutions, HR and ERP systems with AD integration, as well as third-party tools with hard-coded LDAP configurations.
Linux and Unix systems
Systems that authenticate against Active Directory via SSSD, nslcd or pam_ldap are often configured without signing. The default configuration of many Linux distributions uses plain LDAP on port 389.
Network devices and printers
Switches with 802.1X authentication via LDAP, NAS systems with AD integration, and older printer systems are often unable to support Channel Binding. Synology, QNAP and older devices from HP, Canon and Ricoh are particularly affected.
Certificate infrastructure
Often overlooked: Channel Binding requires a valid TLS certificate on the Domain Controllers. Environments without an internal PKI or with expired DC certificates must first set up this infrastructure.
The security risk: a typical attack chain
Initial access
An attacker compromises a client on the internal network, for example via Phishing or an unpatched vulnerability.
Launch Responder
A tool such as Responder is launched. The attacker responds to LLMNR/NBT-NS queries on the network with forged replies.
Intercepting credentials
A client attempts to authenticate itself with a supposed service. The credentials end up with the attacker.
Relay against the Domain Controller
The stolen authentication credentials are relayed directly to the Domain Controller’s LDAP port.
Domain Compromise
Without signing or Channel Binding, the connection is accepted. This enables the creation of admin accounts, delegation or complete domain takeover.
No administrator rights are required. This attack method has been standard practice for years using toolkits such as Impacket and ntlmrelayx, and features in almost every Active Directory Pentest.
Mint Secure GmbH
What administrators need to do now
Enable and analyse auditing
Analyse Event IDs 2886 to 2889 on all Domain Controllers. On WS2019/2022, also analyse 3039 to 3041; on WS2025, analyse 3074 and 3075 as well. Identify affected clients.
Inventory affected systems
List the source IP addresses and host names from the audit events, identify the owners and categorise them according to migration path.
Provide Domain Controllers with TLS certificates
Channel Binding requires valid DC certificates, either via Microsoft AD CS or an external CA.
Migrate applications to LDAPS
Migrate applications from plain LDAP (port 389) to LDAPS (port 636) or LDAP with StartTLS.
Enable enforcement on a trial basis
Set the registry key LDAPServerIntegrity = 2 on a test DC and monitor the effects before rolling out the setting to all DCs.
Carry out a security audit and penetration testing
Only a targeted LDAP relay test will reveal whether the configuration is effective and whether any further attack vectors exist.
PowerShell query for analysis
Get-WinEvent -LogName "Directory Service" |
Where-Object { $_.Id -in @(2887, 2889) } |
Select-Object TimeCreated, Id, Message |
Export-Csv ldap_audit.csv -NoTypeInformation
How Mint Secure can support you
As a specialist IT security service provider, Mint Secure helps organisations to securely migrate and protect their Active Directory infrastructure.
LDAP Audit
We identify all clients and applications that still use unsigned LDAP connections before Microsoft blocks them.
AD Penetration Testing
We simulate LDAP relay, NTLM relay and credential attacks to reveal real attack vectors within your environment.
Hardening & Migration
We support the migration to LDAPS, configure Channel Binding and subsequently validate the implementation through testing.
AD Security Audit
Comprehensive review of delegations, trust relationships, privileges and protocol configuration across the entire Active Directory.
Unsure how badly you’re affected? We’ll analyse your Domain Controller logs together with you. Get in touch now.
Conclusion
LDAP Signing and Channel Binding are not new concepts, but the situation has changed significantly with Windows Server 2025.
New DC deployments with WS2025 enforce LDAP Signing by default. Existing environments (WS2019/2022) are not automatically affected by this, but the risk posed by LDAP relay is real and is exploited in almost every Pentest.
Organisations that take action now will avoid unplanned downtime, close one of the most commonly used attack vectors in Active Directory environments, and significantly reduce the risk of domain compromise. Mint Secure supports you every step of the way, from analysis through to implementation. Get in touch with us.
Sources: Microsoft Learn, LDAP signing for AD DS · KB4520412 · Microsoft Tech Community, LDAP Channel Binding and Signing Requirements for Server 2025 Updates · TrustedSec, LDAP Channel Binding and LDAP Signing (Jan. 2026)
