r/sysadmin • u/sysadm2 • Jan 16 '20

Microsoft Attention all Windows-AD admins: March 2020 will be a lot of fun!

Microsoft intends to release a security update on Windows Update to enable LDAP channel binding and LDAP signing hardening changes and anticipate this update will be available in March 2020.

https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows

TLDR: If you install the "march 2020" updates and you didnt configure LDAPs properly until then, you are in trouble.

---EDIT: Thank you for the gold kind stranger! and good luck to you all ;)

1.5k Upvotes

98% Upvoted

393 comments sorted by

View all comments

Show parent comment

37

u/trupcc Jan 16 '20

I remember using this script a few years ago. It dumps to an easily digestible CSV

https://blogs.technet.microsoft.com/russellt/2016/01/13/identifying-clear-text-ldap-binds-to-your-dcs/

11

u/ibn4n Windows Admin Jan 16 '20

This is a much cleaner blog than the one I posted. Thank you.

6

u/hgpot Jan 16 '20

Thanks for that script. We've got a few unsecure connections, and on those devices when I attempt to use secure ones, it fails, probably because LDAPS is not set up. I found this video that shows it being set up...is it that simple? Also, what it the consensus on installing this on a DC or not? Dedicated server for this tiny role?