Active Directory (past Windows 2000) does not allow anonymous operations other than
rootDSE searches, by default. So, if you are able to bind anonymously to Active Directory, that means one of two things. Either
- You are connecting to RootDSE, for which anonymous binds should be allowed by design.
- You have already modified Active Directory to allow anonymous binds for non-rootDSE operations and now you need to revert that configuration.
Anonymous binds to RootDSE should be allowed, because RootDSE is how most applications obtain information about the directory in order to complete further binds, such as distinguished names of various partitions, etc. No sensitive information is contained within RootDSE, and anonymous binding to RootDSE is how it was designed to work. Things will break if applications cannot bind anonymously to RootDSE.
For instance, if an application wanted to know what authentication mechanisms were supported in order to bind to your AD, it could get that information from the
supportedSASLMechanisms attribute in
RootDSE, but of course this would have to take place before any authentication has taken place, since you don't know yet even what authentication mechanisms you're allowed to use.
Now in the second case, assuming you have enabled anonymous binds to AD for non-RootDSE operations, you disable that by changing the seventh character of the
dsHeuristics attribute on the following directory object:
CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,Root domain in forest
Valid values for the dsHeuristics attribute are 0 and 2. By default,
the dsHeuristics attribute does not exist, but its internal default is
0. If you set the seventh character to 2, anonymous clients can perform any operation that is permitted by the access control list
(ACL). If the attribute is already set, do not modify any bits in the
dsHeuristics string other than the seventh bit. If the value is not
set, make sure that you provide the leading zeros up to the seventh
bit. You can use Adsiedit.msc to make the change to the dsHeuristics
Just to further clarify, there is currently no way to disable anonymous binds to RootDSE. This is not an Active Directory specific thing. This is part of the LDAP v3 specification.