Windows 10: Some DCs require GSSAPI for LDAP connetions

I have weird issue that has cropped up. We have 8 writable Domain Controllers and 2 RODCs, all are 2016.We updated all but 3 DCs to block use of TLS1.0/1.1 and bunch of depricated hashes and cyphers etc.After this we have noticed some issues with LDAP queries from some applications to specific DCs, they appear to make a connection but can not enumerate AD.I have reverted the changes, even to the extent of positively allowing the previously blocked stuff, but the problem persists.Using LDP and LDAPAdmin I can make a connection, however, a Bind fails unless I use GSSAPI on LDAPAdmin and Negotiat

:)

 

eJabberd and LDAP Question

Trying to setup mod_shared_roster_ldap and can't seem to get it to work.

Currently using this config
Code: mod_shared_roster_ldap: ldap_base: "dc=the-culture,dc=eu" ldap_rfilter: "(objectClass=inetOrgPerson)" ldap_groupattr: "corporation" ldap_memberattr: "characterName" ldap_filter: "(memberUid=*)" ldap_userdesc: "characterName"[/quote] With this LDAP setup




My understanding of LDAP is limited as this is the first time I've used it so it's possible I'm missing something basic. But I'm trying to have my contact lists show the users separated based on the corporation attribute.

 

Security update - 2020 LDAP channel binding and LDAP signing requirement for Windows

I have a question related to the security update (2020 LDAP channel binding and LDAP signing requirement for Windows) described

in https://support.microsoft.com/en-us...ding-and-ldap-signing-requirement-for-windows

Is there a way to configure the domain controller, so that even if secure binding becomes enabled by default, application servers (sending the windows credentials to domain controller) can override that in some way to support simple binding?

 

ldaps doesn't work

Hi all,



after restoring the C:\ProgramData\Microsoft\Crypto directory, all services work fine except LDAPS.



The ldp.exe test works fine from the DCs servers but not from a non domain server.

Also tried with ldapsearch via linux without success.



LDAP is ok.



Any advice?

Thanks