Disable LDAP 389 and enforce LDAPS 636 in AD

Question

Disable LDAP 389 and enforce LDAPS 636 in AD

Chong 871

Hi,

We already install the certificate, enable LDAP signing and channel bind in AD. How to configure client’s directory service settings point to the LDAPS port (usually 636)?

Thanks

Bill Witten 0 Reputation points

2025-02-11T14:23:35.06+00:00

The RFC 4511 (the LDAP Standards definition) does not include "LDAPS" on TCP636. The standard defines a process mirroring SMTP in that the STARTTLS command verb is required to secure LDAP traffic via TLS. "LDAPS" over TCP636 is a common usage thing and is not supported in the standard. Thus, Active Directory uses TCP389 and the STARTTLS command verb to sign and secure LDAP traffic. Blocking TCP389 will cause innumerable problems with Active Directoy in both Nortth-South (Client-Server) communications and East-West (server-Server) communications and is not supported in any way, shape or form.

1 answer

Your answer

Bill Witten 0 Reputation points

2025-02-11T14:23:35.06+00:00

The RFC 4511 (the LDAP Standards definition) does not include "LDAPS" on TCP636. The standard defines a process mirroring SMTP in that the STARTTLS command verb is required to secure LDAP traffic via TLS. "LDAPS" over TCP636 is a common usage thing and is not supported in the standard. Thus, Active Directory uses TCP389 and the STARTTLS command verb to sign and secure LDAP traffic. Blocking TCP389 will cause innumerable problems with Active Directoy in both Nortth-South (Client-Server) communications and East-West (server-Server) communications and is not supported in any way, shape or form.

Answer 1

Thameur-BOURBITA 36,076

Hi @Chong •

You can use group policy or registry key:

Fore more information please refer to the following link:

How to set the client LDAP signing requirement by using a domain Group Policy Object

Please don't forget to accept helpful answer

Chong 871 Reputation points

2024-03-20T04:35:35.4766667+00:00

We configured the "Domain controller: LDAP server signing requirements" and "Network security: LDAP client signing requirements" "Require signing" in both Default Domain Controller Policy and Default Domain Policy already, But the client still using 389 port. Any idea?
Thameur-BOURBITA 36,076 Reputation points

2024-03-20T10:40:06.66+00:00

@Chong

It's normale behavior, the port 389 will continue used tby client to send a ping LDAP during the Dclocator process in order to identify the closest domain controller and domain join.

Please don't forget to accept helpful answer
Chong 871 Reputation points

2024-03-21T06:09:29.8366667+00:00
So the 389 port cannot block in the network?

But our case is only 389 traffic, no 636 traffic after applied the GPO
Thameur-BOURBITA 36,076 Reputation points

2024-03-21T07:48:06.3766667+00:00
@Chong •

So the 389 port cannot block in the network?

You should avoid blocking this port 389 because there are certain services which cannot communicate through port 636 and you will have problems such as joining a machine in the domain and dclocator process

Please don't forget to accept helpful asnwer
Chong 871 Reputation points

2024-03-21T09:30:22.19+00:00

If the port 389 cannot blocked, that means the LDAP cannot migrate to use LDAPS in AD, and the transmission still running on port 389 which is unencrypted?
Thameur-BOURBITA 36,076 Reputation points

2024-03-21T10:25:34.6266667+00:00

@Chong •

At the active directory level, it is not a question of LDAP migration to LDAPs, it is a question of forcing the applications to use only the secure LDAPS protocol except for certain functionalities necessary for Windows such as dclocator and the join in the AD. So Active directory should accept the both awaiting a update from microsoft to these windows functionalities to use LDAPS instead of LDAP

LDAP to LDAP migration is at the LDAP application and client level.

Please don't forget to accept helpful answer

Share via

Disable LDAP 389 and enforce LDAPS 636 in AD

1 answer

Your answer