How To Setup LDAPS on Windows Domain Controller Tutorial

[@just1pepsi]

Much better than the 100 other exact replicas of the install process where everyone installs AD LDS unnecessarily. Wish I would've found this video sooner.

[@LukewarmEnthusiast]

+1000000% this comment. This is literally the ONLY video or article I've seen that doesn't mention AD LDS. And I was trying to use a public wildcard cert. My Lord there are so many garbage tutorials on this when it's really simple.

[@patrickbourdeau2469]

Hello, It was clean enough to follow step by step. Thanks a lot for the demo !!!!!!

[@bzavala123]

So, you are saying is all you do to get the needed certs is to install the AD CA run the LDP connection tests and then reboot the server and it will automatically create the needed certs for any DCs you run the LDP tests on a then reboot?

[@shamsmad]

But what if i have CA role on member server not on any DCs .. how i can import the certificate?? Please help

[@davidbelleval]

Thank you so much for your video... very clear and all it works for me now. You'r a boss !!

[@harjeetmakkar5586]

Amazing video, very clear but my doubt is what if we need to enable ldap signing in domain Do i need to push the certificates on all machines in domain including member servers?

[@terratrax]

Thank you for saving me so much time!

[@darshanarajapakse7801]

Thanks for the tutorial. It was very helpful!

[@LeviandBoomer]

thanks for the demo, if I need to install this for the first time in my domain to enable ldaps, would all my member servers need to rebooted?

[@thepadrino6975]

A very good Video. I like it.

[@andrewenglish3810]

where do you get ldp ?? becuase on my new 2019 DCs there is no ldp application installed

[@Tobi4775OP]

What if the certificate is not enrolled - when doing the same steps as you just did - how to troubleshoot that

[@mangaanime7727]

Hello, That was great and straight forward. Very helpful thanks a Million.

[@kagisogaelesiwe1805]

Is there a way to install 3rd party wildcard like RapidSSL signed cert to validate?

[@robertpineiro3415]

Video very intuitive. If I want to restrict LDAP and allow my clients to only authenticate LDAPS would I need force that via my Domain Controller/Domain policies with the option just allow signing request? Is there additional steps beyond enabling signing request only?

[@2lotsill]

Yes, configuring LDAPS (LDAP over SSL) and enforcing signing requests are good security measures. To restrict LDAP and allow only LDAPS, you'll typically need to follow these steps: Install and Configure an SSL Certificate: Obtain or install a valid SSL certificate on your Domain Controller. This is crucial for securing the LDAPS communication. Enable LDAPS on the Domain Controller: Open the "Active Directory Certificate Services" or use a third-party certificate to enable LDAPS. Ensure that the LDAPS port (default is 636) is open in your firewall. Modify Group Policy: Use Group Policy to enforce the use of LDAPS: Open the Group Policy Management Console (GPMC). Navigate to Computer Configuration -> Windows Settings -> Security Settings -> Public Key Policies. In the right pane, double-click on "Certificate Services Client - Auto-Enrollment" and configure it to enable auto-enrollment. Navigate to Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Network Security. In "Domain Member: LDAP Client Signing Requirements," set it to "Require Signing." Configure LDAP Client Applications: Ensure that your LDAP client applications are configured to use LDAPS (port 636). Update any scripts or applications that use plain LDAP to use LDAPS. Firewall Configuration: Adjust your firewall settings to allow traffic on the LDAPS port (636) and block traffic on the regular LDAP port (389) if you want to restrict it. Test the Configuration: Test the LDAPS configuration to ensure that clients can connect securely. Use tools like LDP.exe or LDAPsearch to verify the LDAPS connection. Monitor and Audit: Implement monitoring and auditing to track LDAP and LDAPS activity. Regularly review logs for any security-related events.

[@NateChoiniere]

@@2lotsill Ok GPT thanks

[@237311]

Useful video. Can this work with other type OS like Linux machines? I want them (Linux) to be authenticated against the LDAPS server. Thanks.

[@Johnny87Au]

Is win server 2019 and 2022 all on the same domain mate ? Im a bit lost

[@juancho420]

For security reason you don't want root CA's turned on all the time. You need DCs to be turned on so this is the issue. So far I haven't found anyone setup LDAPS without installing a root ca on a DC, makes me sad.

[@jcmreno]

You can install a separate CA, in fact you should install a root CA and a subordinate CA, the thing is that there is no video for this, I am reading a book to do this safely.

[@juancho420]

@@jcmreno we had to setup FIPS so I created a root and intermmediate CA. CA should definitely not be on a domain controller. I used the PKI Guide from Matthew Burr great stuff.

[@muzzammilabdullah3324]

My enterprise CA is disabled, and i continued with standalone , but after successful configuration i cant see anything under issued certificates even after restart. Also i am not able to connect through ldp.exe both for 389 and 636.

[@ssdiplomat5855]

Hi thanks ! What about non ad joined machines can they connect?

[@sergioegues1009]

NICE VIDEO!!! VERY HELPFUL

[@iamxanderrific]

i plan on installing LDAPS on our RODC for our 69 branches, will this work?

[@DavidTorres-xl2jl]

This video helped me tremendously!! I was building out a Forticlient Cloud EMS server for VPN and all of our root CA Certs were expired and couldn't figure out how to setup LDAPS on DCs. Thanks Sooooo Much!! Do you know how I can export the .PEM file for this Root CA cert to upload to Forticlient Cloud EMS server?

[@ITBandha]

Hey, Have you got a solution with respect to .PEM file for this Root CA.. I'm looking for something similar (Aruba Fabric Composure). Kindly help me out if you have figured out a solution.

[@chandrashekar9698]

Thank you very much :)

[@kevinwirth2548]

thank you so much !

[@lali_sanchez_blog]

Thank you so much!!!

[@invenorofstaw7570]

thanks maaan

[@JohnGiang-um2lq]

If LDAPS:636 is enabled on a Domain Controller, can other connections still utilize LDAP:389 w/out any issues?

[@Matrix.Architect]

Yes, but your connection is un-encrypted and can become compromised more easily.

[@DailyLearnings1]

I guess permissions of duplicate certificate created was required some auto enrollment 😛

[@indianpatriot204]

where is ldp its not available in my machine, cant find any download link also

[@jcmreno]

It is a windows feature.

[@ScryptStudios1]

i love you

[@CaseySchneider]

Installing a CA on a domain is horrible advice...

[@porks0da]

adding a reply with what you say is horrible advice, without providing at least some follow up as to why, or links to articles is Horrible advice as well.

[@jcmreno]

@@porks0da For security purposes, if you need to turn off the CA there is no way to do it, having these roles, same goes for print server, Stability, performance and security.

[@kittyyyyyyyy]

heeha