Thanks for clicking, I'm having an issue with our server where our Active Directory is being abused by random external servers.
From what I can gather, our server is the victim of an LDAP forwarding attack used in DDOS'ing, unfortunately our network is the one being taken down (Attackers abuse exposed LDAP servers to amplify DDoS attacks )
Articles suggest activating Allow the Connection if it is Secure in the windows firewall for
Active Domain Controller - LDAP (UDP-In), which works, but also prevents Active Directory from working on everything else such as external Remote Desktop connections, and it even seems to prevent local network users from connecting to our local MS Exchange email server.
What I'd love to know is how to block these connections without blocking our own systems.
Thanks for reading, I'd love to hear your thoughts.