+1 My question was directed more to the fact that any "Authenticated User" has pretty much full read-access to AD anyway.
-----Original Message----- From: Ben Scott [mailto:mailvor...@gmail.com] Sent: Monday, April 8, 2013 7:14 PM To: NT System Admin Issues Subject: Re: AD Simple LDAP authentication question On Mon, Apr 8, 2013 at 4:03 PM, Christopher Bodnar <christopher_bod...@glic.com> wrote: > I know that AD supports both Simple and SASL methods for LDAP binds: > > http://msdn.microsoft.com/en-us/library/cc223499.aspx > > What I was surprised is that there doesn't seem to be a way to disable > the Simple method. It supports SSL/TLS but does not require it. Is that > correct? I don't really know, but I do know that our Windows 2008 R2 domain controllers log the event below once a day. I know what's causing it and haven't cared enough to do something about it. The link takes you to a KB article which tells you how to require *signing*. It talks a lot about simple binds but doesn't explicitly say that requiring signing also causes it to reject simple binds, but seems to imply it pretty strongly. Source: ActiveDirectory_DomainService Event ID: 2886 --------------------------------------------------------------------- The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that are performed on a cleartext (non-SSL/TLS-encrypted) connection. Even if no clients are using such binds, configuring the server to reject them will improve the security of this server. Some clients may currently be relying on unsigned SASL binds or LDAP simple binds over a non-SSL/TLS connection, and will stop working if this configuration change is made. To assist in identifying these clients, if such binds occur this directory server will log a summary event once every 24 hours indicating how many such binds occurred. You are encouraged to configure those clients to not use such binds. Once no such events are observed for an extended period, it is recommended that you configure the server to reject such binds. For more details and information on how to make this configuration change to the server, please see http://go.microsoft.com/fwlink/?LinkID=87923. You can enable additional logging to log an event each time a client makes such a bind, including information on which client made the bind. To do so, please raise the setting for the "LDAP Interface Events" event logging category to level 2 or higher. ---------------------------------------------------------------------- FWIW, YMMV, HTH, HAND, AT&T. -- Ben ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin ~ Finally, powerful endpoint security that ISN'T a resource hog! ~ ~ <http://www.sunbeltsoftware.com/Business/VIPRE-Enterprise/> ~ --- To manage subscriptions click here: http://lyris.sunbelt-software.com/read/my_forums/ or send an email to listmana...@lyris.sunbeltsoftware.com with the body: unsubscribe ntsysadmin
