Event ID/Source search
Keyword searchExample: Windows cannot unload your registry file
Event ID: 2886 Source: ActiveDirectory_DomainService
The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate Kerberos NTLM or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that are performed on a cleartext (non-SSL/TLS-encrypted) connection. Even if no clients are using such binds configuring the server to reject them will improve the security of this server.
Some clients may currently be relying on unsigned SASL binds or LDAP simple binds over a non-SSL/TLS connection and will stop working if this configuration change is made. To assist in identifying these clients if such binds occur this directory server will log a summary event once every 24 hours indicating how many such binds occurred. You are encouraged to configure those clients to not use such binds. Once no such events are observed for an extended period it is recommended that you configure the server to reject such binds.
For more details and information on how to make this configuration change to the server please see http://go.microsoft.com/fwlink/LinkID=87923.
You can enable additional logging to log an event each time a client makes such a bind including information on which client made the bind. To do so please raise the setting for the "LDAP Interface Events" event logging category to level 2 or higher.
|English: Request a translation of the event description in plain English.|
According to EV100630 (Event ID 2886 — LDAP signing), the solution to this is to configure the directory to reject LDAP binds that do not require signing on the DC and AD LDS servers. See the blog entry for more details.
The two GPOs to configure to remove this warning are:
- Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network Security: LDAP client signing requirements = negotiate signing.
- Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Domain controller: LDAP server signing requirements = require signing.
See ME823659 for more details.
|Private comment: Subscribers only. See example of private comment|
|Search: Google - Bing - Microsoft - Yahoo - EventID.Net Queue (0) - More links...|
Send comments or solutions
- Notify me when updated