Configuring the signing requirement for the LDAP server
3 July 2024
ID 272729
Configuring using the Group Policy Management Console
To configure the signing requirement for the LDAP server using the Group Policy Management Console:
- Press Win+R, enter
gpmc.msc
in the displayed window, and press Enter.This opens the Group Policy Management snap-in.
- In the console tree, select Forest <domain name> → Domains → <domain name>.
- In the context menu of the Default Domain Policy object, select Edit.
- In the Group Policy Management Editor window, select Computer Configuration → Policies → Windows Settings → Security Settings → Local Policies → Security Options, and in the workspace, select the Domain controller: LDAP server signing requirements policy.
- In the policy properties window, select the Define this policy setting check box and in the drop-down list below, select Require signing.
- Click OK.
- Bind the group policy object to the domain container in Active Directory.
Configuring using the registry editor
To configure the signing requirement for the LDAP server using the registry editor:
- Press Win+R, enter
regedit
in the displayed window, and press Enter.This opens the Registry Editor window.
- Navigate to the following key: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters.
- For the Parameters key, create a new DWORD (32-bit) value named LDAPServerIntegrity that has the value of
2
. - Restart the Active Directory controller to apply the changes.
- Repeat steps 1 to 4 on each Active Directory domain controller.
Configuring using PowerShell
To configure the signing requirement for the LDAP server using PowerShell:
On each Active Directory domain controller, run the following command:
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Services\NTDS\Parameters' –Name LDAPServerIntegrity –Value 2
When the changes are applied on the Active Directory domain controller, the LDAP client signing requirement setting can be changed to Require signing.