I have set up Active Directory on a Windows 2012R2 machine. I have been trying to disable Anonymous Binding to the AD but have not yet figured out how to do that. As a result, I am able to do bind to the AD using just the IP address and a program such as an LDAP browser.

How can I disable anonymous binding?

  • What have you already tried? – Ryan Bolger May 20 '15 at 13:14

Active Directory (past Windows 2000) does not allow anonymous operations other than rootDSE searches, by default. So, if you are able to bind anonymously to Active Directory, that means one of two things. Either

  • You are connecting to RootDSE, for which anonymous binds should be allowed by design.
  • You have already modified Active Directory to allow anonymous binds for non-rootDSE operations and now you need to revert that configuration.

Anonymous binds to RootDSE should be allowed, because RootDSE is how most applications obtain information about the directory in order to complete further binds, such as distinguished names of various partitions, etc. No sensitive information is contained within RootDSE, and anonymous binding to RootDSE is how it was designed to work. Things will break if applications cannot bind anonymously to RootDSE.

For instance, if an application wanted to know what authentication mechanisms were supported in order to bind to your AD, it could get that information from the supportedSASLMechanisms attribute in RootDSE, but of course this would have to take place before any authentication has taken place, since you don't know yet even what authentication mechanisms you're allowed to use.

Read: https://msdn.microsoft.com/en-us/library/ms677945(v=vs.85).aspx

Now in the second case, assuming you have enabled anonymous binds to AD for non-RootDSE operations, you disable that by changing the seventh character of the dsHeuristics attribute on the following directory object:

CN=Directory Service,CN=Windows NT,CN=Services,CN=Configuration,Root domain in forest

Valid values for the dsHeuristics attribute are 0 and 2. By default, the dsHeuristics attribute does not exist, but its internal default is 0. If you set the seventh character to 2, anonymous clients can perform any operation that is permitted by the access control list (ACL). If the attribute is already set, do not modify any bits in the dsHeuristics string other than the seventh bit. If the value is not set, make sure that you provide the leading zeros up to the seventh bit. You can use Adsiedit.msc to make the change to the dsHeuristics attribute.

Just to further clarify, there is currently no way to disable anonymous binds to RootDSE. This is not an Active Directory specific thing. This is part of the LDAP v3 specification.

Read: https://technet.microsoft.com/en-us/library/cc755809%28v=ws.10%29.aspx

Read: http://www.selfadsi.org/bind.htm

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.