KB4520412: LDAP or LDAPS? Harden your AD domain with LDAP Integrity - Practical Lesson

We can require LDAP Signing since March 2020 with KB4520412. In this video we describe the differences among LDAP, LDAPS and LDAP Secure. After that, we check the different policies that can be used to harden LDAP: either with LDAP signing, LDAP sealing or SSL encryption with Windows Server 2025 and older. Chapters: 00:00 Introduction 00:12 Practice requirements 02:33 LDAP, LDAPS and LDAP Secure differences 05:02 Policies for LDAP Secure 19:54 Testing without any hardening 37:14 Testing Domain Controller: LDAP Server Signing Requirements 43:59 Testing Domain Controller: LDAP Server Signing Requirements Enforcement 45:51 Testing Network Security: LDAP Client Signing Requirements 56:10 Testing Network Security: LDAP Client Encryption Requirements 01:03:18 Final thoughts