Home / server / Questions / 589625
Accepted
LeeM
Asked: 2014-04-17 21:42:02 +0800 CST

Auditing anonymous binds to AD LDAP

  • 772

We're about to commence an AD upgrade to 2012 R2, and I have just found to my horror that anonymous LDAP binds have been enabled in the 2003 domain.

We've certainly been issuing accounts for LDAP auth to non-Windows systems by policy, but before disabling the anonymous bind, we should probably do some due diligence to ensure no-one's just taking the anonymous shortcut.

Any suggestions has to how to audit anonymous operations in LDAP? Obviously it's possible to enable AD debug diagnostic logging, or perhaps use a tool like ADInsight, but I would have no idea what events to filter for.

windows-server-2003

1 Answers

  1. Best Answer

    According to Microsoft PSS, there is no way of auditing whether the bind is anonymous or not.

    If you enable the ldap debug log, it shows the bind activity, but it won't show any auth method that was used.

    • 0