11

I have installed an LDAP browser, to try and browse my AD information (this is part of enabling Google Directory Sync process).

however, I keep getting a connection error (using port: 19389).

the first Q I have: Is my Active Directory (2003R2 Server) is already an LDAP server? (from the readings I understand that Each AD is an implementation of LDAP) - so my answer would be yes.

In that case, why can't I connect? Is there any setting to enable such "LDAP" connections? (I feel not) I feel I am missing some crucial piece of information.

*I am using JXplorer as the LDAP browser

This Ansewr MS Active Directory as a simple LDAP server directs me to use: ADAM - but I can't see how this helps me.

3 Answers 3

12

Yes, AD has LDAP as one component. You don't need to do anything to AD to allow an LDAP client to connect.

You need to bind (authenticate) to LDAP to be able to browse it; you need to put in your full DN in JXplorer as part of the credentials, and of course your password. Without knowing what you've tried so far, I can't give you much more direction.

Having said all that, I prefer ADExplorer from Sysinternals to a plain-jane LDAP browser. It's a little easier to use, since it's meant for use with AD specifically.

ADAM (AD LDS) is what you would use if you needed something almost entirely like AD, without needing an actual domain.

5
  • thank you for your answer. What password do i put in? of the Domain Administrator? that gives me another error: Initializing... Error: Invalid credentials or privileges Exception: javax.naming.AuthenticationException: [LDAP: error code 49 - 80090308: LdapErr: DSID-0C090334, comment: AcceptSecurityContext error, data 525, vece
    – Saariko
    Jul 26, 2011 at 13:48
  • 1
    You put in the password of the account whose DN you're using. It doesn't need to be a domain admin; any account within AD can bind to LDAP and browse.
    – mfinni
    Jul 26, 2011 at 13:51
  • Thanks again, I have downlaoded ADExplorer, just to get/copy the full DN. I still get a connection error on my Configuration Manager for the Google Directory Sync. (I'll start a new QA for this) thanks.
    – Saariko
    Jul 26, 2011 at 13:58
  • Solved it as well. I needed to use: domain\ administrator as the username and not just: administrator
    – Saariko
    Jul 26, 2011 at 14:07
  • 1
    BTW, I believe ldp.exe is built into the OS, so you can use that as well. That's what I've always used to connect and browse AD.
    – TheCleaner
    Jul 26, 2011 at 14:30
3

Windows LDAP answers on port 389.

1

From the Microsoft document titled Active Directory's LDAP Compliance:

Windows Server 2003

Building on the foundation established in Windows 2000 Server, the Active Directory service in Windows Server 2003 extends beyond the baseline of LDAP compliance into one of the most comprehensive directory servers offering a wide range of LDAP support. Accordingly, the Windows Server 2003 Active Directory service introduces a number of new LDAP capabilities targeted for IT professionals and application developers. Some of the latest LDAP features include:

•Dynamic Entries - Active Directory can store dynamic entries allowing the directory to assign Time-To-Live (TTL) values to determine automatic entry deletion.

•Transport Layer Security (TLS) - Connections to Active Directory over LDAP can now be protected using the TLS security protocol.

1
  • 2
    Please attribute your copy/pastes with, at least, a link to the source.
    – jscott
    Jul 26, 2011 at 15:53

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .