Saxeexa LDAP^{(LDAP signing)} waa habka xaqiijinta ee Windows Server - ka kaas oo wanaajin kara amniga serfarka hagaha. Marka la furo, way diidi doontaa codsi kasta oo aan waydiisan saxeexa ama haddii codsiga la isticmaalayo sir aan SSL/TLS ahayn. Maqaalkan, waxaanu ku wadaagi doonaa sida aad awood ugu yeelan karto saxeexa LDAP ee ^(LDAP)Windows Server iyo mishiinada macmiilka. LDAP waxay u taagan tahay   Hab-raaca Helitaanka Hagaha Fudud^{(Lightweight Directory Access Protocol)} (LDAP).

Sida loo sahlo saxiixa LDAP kombayutarada Windows

Si loo hubiyo in qofka wax weeraray aanu isticmaalin macmiil LDAP been abuur ah si uu u bedelo habaynta serverka iyo xogta, waxa lama huraan u ah in la suurtogeliyo saxiixa LDAP . Si la mid ah ayey muhiim u tahay in lagu sahlo mishiinnada macmiilka.

1. Deji^(Set) shuruudaha saxiixa LDAP server
2. Deji^(Set) shuruudaha saxiixa LDAP ee macmiilka adiga oo isticmaalaya siyaasada kombuyuutarka maxaliga ah^(Local)
3. Deji^(Set) shuruudaha saxiixa LDAP ee macmiilka adiga oo isticmaalaya Shayga Siyaasadda Kooxda Domain^{(Domain Group Policy Object)}
4. Deji^(Set) shuruudaha saxiixa LDAP ee macmiilka adiga oo isticmaalaya furayaasha Diiwaanka^(Registry)
5. Sida loo xaqiijiyo isbeddelada qaabeynta
6. Sida loo helo macaamiisha aan isticmaalin ikhtiyaarka " u baahan^(Require) saxiixa "

Qaybta ugu danbeysa waxay kaa caawinaysaa inaad ogaato macaamiisha aan u baahnayn saxeexa^{(do not have Require signing enabled)} kumbiyuutarka. Waa qalab waxtar u leh maamulayaasha IT-ga si ay u go'doomiyaan kombuyuutarradaas, oo ay awood u yeeshaan goobaha amniga ee kombuyuutarrada.

1] Deji^(Set) shuruudaha saxiixa LDAP ee serverka

1. Fur Console Maamulka Microsoft^{(Microsoft Management Console)} (mmc.exe)
2. Dooro Faylka>  Kudar^(Add) /kasaar Snap-in> dooro  Tifaftiraha Shayga Siyaasadda Kooxda^{(Group Policy Object Editor)} , ka dibna dooro  Ku dar^(Add) .
3. Waxay furi doontaa Wizard Siyaasadda Kooxda^{(Group Policy Wizard)} . Guji badhanka ^(Click)Browse , oo dooro  Siyaasadda Domain Default^{(Default Domain Policy)} halkii aad ka isticmaali lahayd Kombuyuutarka Maxalliga ah
4. Guji^(Click) badhanka OK, ka dibna badhanka dhame^(Finish) , oo xidh.
5. Dooro  Default Domain Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies , ka dibna dooro Doorashooyinka Ammaanka.
6. Midig ku dhufo  Koontaroolka Domain-ka: Shuruudaha saxiixa server-ka LDAP^{(Domain controller: LDAP server signing requirements)} , ka dibna dooro Guryaha.
7. Xakamaynta Domain -ka  : Shuruudaha saxeexa serferka LDAP  Sanduuqa wada hadalka  Guryaha , karti ^(Properties)Qeexee^(Define) dejinta siyaasadan, dooro u  baahan saxeexa Qeexi liiska dejinta siyaasada,^{(Require signing in the Define this policy setting list,)} ka dibna dooro OK.
8. Dib u hubi dejinta oo dabaq iyaga.

2] Deji^(Set) shuruudaha saxiixa LDAP ee macmiilka adiga oo isticmaalaya siyaasadda kombuyuutarka maxalliga ah

1. Fur degdegga^(Run) ah, oo ku qor gpedit.msc, oo taabo furaha Gelida^(Enter) .
2. Tafatiraha siyaasadda kooxda, u Local Computer Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies , ka dibna dooro  Doorashooyinka Ammaanka.^{(Security Options.)}
3. Midig ku dhufo amniga shabakada: Shuruudaha saxiixa macmiilka LDAP^{(Network security: LDAP client signing requirements)} , ka dibna dooro Guryaha.
4. Amniga  Shabakadda^(Network) : Shuruudaha saxiixa macmiilka LDAP Sanduuqa wada hadalka ^(LDAP)Guryaha^(Properties)  , dooro u  baahan saxeexa^{(Require signing)} liiska ka dibna dooro OK.
5. Xaqiiji isbeddelada oo ku dabaq.

3] Deji shuruudaha saxiixa ^(Set)LDAP ee macmiilka adiga oo isticmaalaya Shayga Siyaasadda Kooxda ee^{(Group Policy Object)} domainka

1. Fur Console Maamulka Microsoft (mmc.exe)^{(Open Microsoft Management Console (mmc.exe))}
2. Dooro  Faylka^(File)  >  Add/Remove Snap-in >  dooro  Tifaftiraha Shayga Siyaasadda Kooxda^{(Group Policy Object Editor)} , ka dibna dooro  Ku dar^(Add) .
3. Waxay furi doontaa Wizard Siyaasadda Kooxda^{(Group Policy Wizard)} . Guji badhanka ^(Click)Browse , oo dooro  Siyaasadda Domain Default^{(Default Domain Policy)} halkii aad ka isticmaali lahayd Kombuyuutarka Maxalliga ah
4. Guji^(Click) badhanka OK, ka dibna badhanka dhame^(Finish) , oo xidh.
5. Dooro  Nidaamka Domain Default^{(Default Domain Policy)}  >  Habaynta Kombiyuutarka^{(Computer Configuration)}  >  Dejinta Windows^{(Windows Settings)}  >  Dejinta Amniga^{(Security Settings)}  >  Xeerarka Maxalliga ah^{(Local Policies)} , ka dibna dooro  Doorashooyinka Ammaanka^{(Security Options)} .
6. Amniga  Shabakadda: Shuruudaha saxiixa macmiilka LDAP ^{(Network security: LDAP client signing requirements Properties )} Sanduuqa wada hadalka Guryaha, dooro u  baahan saxeexa ^{(Require signing )} liiska ka dibna dooro  OK .
7. Xaqiiji^(Confirm) isbeddelada oo mari dejinta

4] Deji shuruudaha saxiixa ^(Set)LDAP macmiilka adiga oo isticmaalaya furayaasha diiwaangelinta

Waxa ugu horreeya oo ugu muhiimsan in la sameeyo waa in aad kayd ka qaadato diiwaankaaga

• Furo Tifaftiraha Diiwaanka
• U HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ <InstanceName> \Parameters
• Midig ku dhufo^{(Right-click)} shayga midig, oo samee DWORD cusub oo leh magaca LDAPServerIntegrity
• U dhaaf qiimihiisii ​​caadiga ahaa.

<InstanceName >: Magaca tusaalaha AD LDS^{(AD LDS)} ee aad rabto inaad beddesho.

5] Sida^(How) loo xaqiijiyo haddii qaabeynta isbedelku hadda u baahan yahay saxiix

Si loo hubiyo in siyaasadda ammaanku ay halkan ku shaqaynayso waa sida loo hubiyo daacadnimadeeda.

1. Saxeex kombuyuutar uu ku rakiban yahay AD DS Admin Tools .
2. Fur degdegga ah, oo ku qor ldp.exe^(Run) , oo taabo furaha Gelida^(Enter) . Waa UI loo isticmaalo ka dhex dhex maris meelaynta Hagaha^{(Active Directory)} Active
3. Dooro Xidhiidhka > Isku xidhka.
4. Gudaha  Server -  ka iyo  Dekedda^(Port) , ku qor magaca server-ka iyo dekedda aan SSL/TLS ahayn ee seerfarkaaga, ka dibna dooro OK.
5. Ka dib markii xiriir la sameeyo, dooro Connection> Bind.
6. Nooca bind  hoostiisa^(Bind) , dooro  xidhid fudud^(Simple) .
7. Ku qor magaca isticmaalaha iyo erayga sirta ah, ka dibna dooro OK.

Haddii aad hesho fariin khalad ah oo leh  Ldap_simple_bind_s() guuldareystay: Xaqiijin adag ayaa loo baahan yahay^{(Ldap_simple_bind_s() failed: Strong Authentication Required)} , ka dib waxaad si guul leh u habaysay server-kaaga hagaha.

6] Sida^(How) loo helo macaamiisha aan isticmaalin ikhtiyaarka " u baahan^(Require) saxiixa "

Mar kasta oo mashiinka macmiilku ku xidho server-ka isagoo isticmaalaya hab maamuuska isku xirka amniga, wuxuu abuuraa Aqoonsiga Dhacdada 2889^{(Event ID 2889)} . Gelida loggu waxa kale oo ka koobnaan doona ciwaanka IP-ga ee macaamiisha. Waxaad u baahan doontaa inaad tan karti u yeelatid adiga oo dejinaya 16  LDAP Interface Events  goobta ogaanshaha  2 (Aasaasiga ah). ^{(2 (Basic). )}Baro sida loo habeeyo AD iyo LDS dhacdada ogaanshaha ogaanshaha halkan Microsoft^{(here at Microsoft)} .

Saxeexa LDAP^{(LDAP Signing)} waa muhiim, waxaana rajeynayaa in uu awooday inuu kaa caawiyo inaad si cad u fahanto sida aad awood ugu yeelan karto saxiixa LDAP gudaha ^(LDAP)Windows Server , iyo mishiinada macmiilka.

How to enable LDAP signing in Windows Server & Client Machines

LDAP signing is an authentication method in Windows Server that can improve the security of a directory server. Once enabled, it will reject any request that doesn’t ask for signing or if the request is using non-SSL/TLS-encrypted. In this post, we will share how you can enable LDAP signing in Windows Server and client machines. LDAP stands for  Lightweight Directory Access Protocol (LDAP).

How to enable LDAP signing in Windows computers

To make sure that the attacker doesn’t use a forged LDAP client to change server configuration and data, it is essential to enabling LDAP signing.  It is equally important to enable it on the client machines.

1. Set the server LDAP signing requirement
2. Set the client LDAP signing requirement by using Local computer policy
3. Set the client LDAP signing requirement by using the Domain Group Policy Object
4. Set the client LDAP signing requirement by using Registry keys
5. How to verify configuration changes
6. How to find clients that do not use the “Require signing” option

The last section helps you to figure out clients that do not have Require signing enabled on the computer. It is a useful tool for IT admins to isolate those computers, and enable the security settings on the computers.

1] Set the server LDAP signing requirement

1. Open Microsoft Management Console (mmc.exe)
2. Select File > Add/Remove Snap-in > select Group Policy Object Editor, and then select Add.
3. It will open the Group Policy Wizard. Click on the Browse button, and select Default Domain Policy instead of Local Computer
4. Click on the OK button, and then on the Finish button, and close it.
5. Select Default Domain Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies, and then select Security Options.
6. Right-click Domain controller: LDAP server signing requirements, and then select Properties.
7. In the Domain controller: LDAP server signing requirements Properties dialog box, enable Define this policy setting, select Require signing in the Define this policy setting list, and then select OK.
8. Recheck the settings and apply them.

2] Set the client LDAP signing requirement by using local computer policy

1. Open Run prompt, and type gpedit.msc, and press the Enter key.
2. In the group policy editor, navigate to Local Computer Policy > Computer Configuration > Policies > Windows Settings > Security Settings > Local Policies, and then select Security Options.
3. Right-click on Network security: LDAP client signing requirements, and then select Properties.
4. In the Network security: LDAP client signing requirements Properties dialog box, select Require signing in the list and then choose OK.
5. Confirm changes and apply them.

3] Set the client LDAP signing requirement by using a domain Group Policy Object

1. Open Microsoft Management Console (mmc.exe)
2. Select File > Add/Remove Snap-in > select Group Policy Object Editor, and then select Add.
3. It will open the Group Policy Wizard. Click on the Browse button, and select Default Domain Policy instead of Local Computer
4. Click on the OK button, and then on the Finish button, and close it.
5. Select Default Domain Policy > Computer Configuration > Windows Settings > Security Settings > Local Policies, and then select Security Options.
6. In the Network security: LDAP client signing requirements Properties dialog box, select Require signing in the list and then choose OK.
7. Confirm changes and apply the settings.

4] Set the client LDAP signing requirement by using registry keys

The first and foremost thing to do is take a backup of your registry

• Open Registry Editor
• Navigate to HKEY_LOCAL_MACHINE \ SYSTEM \ CurrentControlSet \ Services \ <InstanceName> \Parameters
• Right-click on the right pane, and create a new DWORD with name LDAPServerIntegrity
• Leave it to its default value.

<InstanceName>: Name of the AD LDS instance that you want to change.

5] How to verify if configuration changes now require sign-in

To make sure the security policy is working here is how to check its integrity.

1. Sign in to a computer that has the AD DS Admin Tools installed.
2. Open Run prompt, and type ldp.exe, and press the Enter key. It is a UI used for navigating through the Active Directory namespace
3. Select Connection > Connect.
4. In Server and Port, type the server name and the non-SSL/TLS port of your directory server, and then select OK.
5. After a connection is established, select Connection > Bind.
6. Under Bind type, select Simple bind.
7. Type the user name and password, and then select OK.

If you receive an error message saying  Ldap_simple_bind_s() failed: Strong Authentication Required, then you have successfully configured your directory server.

6] How to find clients that do not use the “Require signing” option

Every time a client machine connects to the server using an insecure connection protocol, it generates Event ID 2889.  The log entry will also contain the IP addresses of the clients. You will need to enable this by setting the 16 LDAP Interface Events diagnostic setting to 2 (Basic). Learn how to configure AD and LDS diagnostic event logging here at Microsoft.

LDAP Signing is crucial, and I hope the was able to help you clearly understand how you can enable LDAP signing in Windows Server, and on the client machines.

Related posts

• Ku Habee Qufulka Koontada Helitaanka Fog ee Windows Server

• Dami Saamiyada Maamulka ee Windows Server-ka

• Iperius Backup waa kaabta software bilaash ah oo loogu talagalay Windows Server

• Sida loo cadaadiyo Hives Registry Bloated in Windows Server

• Sida Loo Awood & Habeeyo Duqowga & Waxyeelaynta DNS gudaha Serverka Windows

• RSAT waxay maqan tahay aaladaha server-ka DNS ee gudaha Windows 10

• Fix ma gaadhi karo cilada VPN Server ee ku jirta PIA Windows 11

• Software-ka Macmiilka FTP ugu fiican ee bilaashka ah ee Windows 10 PC

• Meel fog laga galo Windows XP ama Windows Server 2003 Computer

• Isku-dubarid Windows 10 Saacad iyo Adeeg-bixiyaha Wakhtiga Internetka

• Khaladaadka Bakhaarka Daaqadaha Dabiiciga Adeegaha ayaa Turun-maray

• Sida loo hagaajiyo 'RPC Server waa lama heli karo' qalad gudaha Windows

• Sida otomaatig loogu sameeyo kaydka Windows Server ee Amazon S3

• Hagaaji ARK Aan awoodin in la waydiiyo macluumaadka adeegaha ee martiqaadka

• Hagaaji Server-kaaga DNS waxaa laga yaabaa inuu yahay qalad aan la heli karin

• Aaladda Adeegga Dadweynaha ee DNS waa beddelka DNS bilaashka ah ee Windows 10

• Ku-celinta VMware Mashiinnada Virtual oo leh Server-kaabeedka Azure

• Sida loo habeeyo Global Proxy Server Settings gudaha Windows 10

• Hagaaji Server-ka Cilad Aan Laga helin Firefox

• Sida looga tago Server Discord (2022)