2

We're about to commence an AD upgrade to 2012 R2, and I have just found to my horror that anonymous LDAP binds have been enabled in the 2003 domain.

We've certainly been issuing accounts for LDAP auth to non-Windows systems by policy, but before disabling the anonymous bind, we should probably do some due diligence to ensure no-one's just taking the anonymous shortcut.

Any suggestions has to how to audit anonymous operations in LDAP? Obviously it's possible to enable AD debug diagnostic logging, or perhaps use a tool like ADInsight, but I would have no idea what events to filter for.

Improve this question

1 Answer 1

Reset to default
0

According to Microsoft PSS, there is no way of auditing whether the bind is anonymous or not.

If you enable the ldap debug log, it shows the bind activity, but it won't show any auth method that was used.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .