Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have installed an LDAP browser, to try and browse my AD information (this is part of enabling Google Directory Sync process).

however, I keep getting a connection error (using port: 19389).

the first Q I have: Is my Active Directory (2003R2 Server) is already an LDAP server? (from the readings I understand that Each AD is an implementation of LDAP) - so my answer would be yes.

In that case, why can't I connect? Is there any setting to enable such "LDAP" connections? (I feel not) I feel I am missing some crucial piece of information.

*I am using JXplorer as the LDAP browser

This Ansewr MS Active Directory as a simple LDAP server directs me to use: ADAM - but I can't see how this helps me.

share|improve this question
up vote 9 down vote accepted

Yes, AD has LDAP as one component. You don't need to do anything to AD to allow an LDAP client to connect.

You need to bind (authenticate) to LDAP to be able to browse it; you need to put in your full DN in JXplorer as part of the credentials, and of course your password. Without knowing what you've tried so far, I can't give you much more direction.

Having said all that, I prefer ADExplorer from Sysinternals to a plain-jane LDAP browser. It's a little easier to use, since it's meant for use with AD specifically.

ADAM (AD LDS) is what you would use if you needed something almost entirely like AD, without needing an actual domain.

share|improve this answer
thank you for your answer. What password do i put in? of the Domain Administrator? that gives me another error: Initializing... Error: Invalid credentials or privileges Exception: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece – Saariko Jul 26 '11 at 13:48
You put in the password of the account whose DN you're using. It doesn't need to be a domain admin; any account within AD can bind to LDAP and browse. – mfinni Jul 26 '11 at 13:51
Thanks again, I have downlaoded ADExplorer, just to get/copy the full DN. I still get a connection error on my Configuration Manager for the Google Directory Sync. (I'll start a new QA for this) thanks. – Saariko Jul 26 '11 at 13:58
Solved it as well. I needed to use: domain\ administrator as the username and not just: administrator – Saariko Jul 26 '11 at 14:07
BTW, I believe ldp.exe is built into the OS, so you can use that as well. That's what I've always used to connect and browse AD. – TheCleaner Jul 26 '11 at 14:30

Yes, Domain Controllers speak LDAP.

  • LDAP port 389
  • LDAP+SSL port 636

As we run Google Apps Directory Sync directly on a DC, I just use port 389. You do, of course, have the option to connect using LDAP+SSL.

enter image description here

share|improve this answer

Windows LDAP answers on port 389.

share|improve this answer

From the Microsoft document titled Active Directory's LDAP Compliance:

Windows Server 2003

Building on the foundation established in Windows 2000 Server, the Active Directory service in Windows Server 2003 extends beyond the baseline of LDAP compliance into one of the most comprehensive directory servers offering a wide range of LDAP support. Accordingly, the Windows Server 2003 Active Directory service introduces a number of new LDAP capabilities targeted for IT professionals and application developers. Some of the latest LDAP features include:

•Dynamic Entries - Active Directory can store dynamic entries allowing the directory to assign Time-To-Live (TTL) values to determine automatic entry deletion.

•Transport Layer Security (TLS) - Connections to Active Directory over LDAP can now be protected using the TLS security protocol.

share|improve this answer
Please attribute your copy/pastes with, at least, a link to the source. – jscott Jul 26 '11 at 15:53

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.