After an audit, I am trying to identify the applications generating anonymous binds on the Domain Controllers before the remediation happens.

So far, we only have the DCs logs, and that doesn't really give us an idea on what is causing these anonymous binds on the server.

Is there a way I could audit that from the server-side? The two options we have identified so far are:

  • Windows Systems Logs, but it is likely to miss part of the picture
  • Capturing the network traffic on the server and looking for packets towards the DCs

migrated from security.stackexchange.com May 14 at 10:59

This question came from our site for information security professionals.

  • I'm not aware a good way to assess this. If you are/were synchronizing with another directory, that is typically why this would be enabled. Also, allowing anonymous binds is not a security risk for most environments, because a principal would still need to authenticate to read almost any data, except for the rootDSE info. – Greg Askew May 14 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy