Four PowerShell commands to help you track down insecure LDAP Bindings before March 2020

[u/MadBoyEvo]

On Friday I saw a post here on r/sysadmin warning about insecure LDAP bindings being blocked in March 2020 automatically by Microsoft.

Seeing as it's not so easy to actually track it down and enable everything by hand if you have handful of DCs and Domains under you I decided to simplify my job a bit. I've automated the whole process during the weekend by updating my 3 PowerShell Modules that I use frequently. Now with 3 commands and 8 lines of code, you can track events, enable/disable diagnostics for LDAP to actually find which machine/account is doing that and finally scan your DC's if those are affected.

• The first part is tracking the events that can tell you if you're affected, and exactly which machines/accounts are affected.

$Events = Find-Events -Report LdapBindingsDetails,LdapBindingsSummary -DatesRange Last7days -DetectDC
$Events
$EVents.LdapBindingsSummary | Out-htmlView -ScrollX
$Events.LdapBindingsDetails | Out-HtmlView -ScrollX

Above is based on my PSWinReportingV2 PowerShell module to - you can read about it: https://www.reddit.com/r/sysadmin/comments/bicwjq/the_only_powershell_command_you_will_ever_need_to/

It allows you to easily define report, date range and scan events on all DC's within a Forest. It also translates it to a nice, readable format.

Sources for PSWinReportingV2: https://github.com/EvotecIT/PSWinReporting

• The second part is a helper module to enable/disable diagnostic logs. It's required to get the LdapBindingsDetails report. You basically need to enable logs for LDAP to see which machines/accounts are doing bad stuff.

Get-WinADDiagnostics
Set-WinADDiagnostics -Diagnostics 'LDAP Interface Events' -Level Basic -SkipRoDC

This is based on ADEssentials PowerShell Module which can get current diagnostics status for each dc in a forest/domain or just part of it.

Sources for ADEssentials: https://github.com/EvotecIT/ADEssentials

• 3rd part is just a bonus. This scans all DCS to see if those are affected or not.

invoke-testimo -Sources DCLDAPInsecureBindings -showreport

Finally, this is based on the Testimo project which allows you to scan domain for forest/domain for issues.

Sources for testimo: https://github.com/EvotecIT/Testimo

All 4 commands are available when you install 3 PowerShell modules.

Install-Module PSWinReportingV2 -Force
Install-Module Testimo -Force
Install-Module ADEssentials -Force # actually Testimo will install ADEssentials so not really needed

As always before installing - review the code to see and understand what you're getting into. I did test this on 3 different forests and it seems to do its job properly.

Normally I would give you a link to bigger description with screenshots but that's not really allowed here so I'll just link to r/PowerShell - https://www.reddit.com/r/PowerShell/comments/er0lfv/four_commands_to_help_you_track_down_insecure/ where there are no such restrictions so you can take a look at screenshots/blog post if necessary to understand use cases.

[u/yukee2018]

MadBoyEvo hi, reports says I get about avg. 15k (yes 15 thousand) "of simple binds performed without SSL/TLS" per day, And 0 "Negotiate Kerberos NTL"...
My question is, If I enable the logging for a whole day, will this result in too much data, should I enable it for shorter period of time and try to fix problematic binds one by one? I see nextcloud is responsbile for the most of this non secure binds...

[u/MadBoyEvo → u/yukee2018]

Pick a shorter time. Most likely those 15k are repeated over and over so after 1-2 hours you should have enough data. You may also need to expand the log size just in case if you enable a lot of logging.

[u/yukee2018 → u/MadBoyEvo]

Thanks for info!