!!! Overview
[{$pagename}] is a concept within [Microsoft Windows] during [LDAP] [Bind Request] for providing [Integrity] validation and is part [ADV190023] and [LDAPServerIntegrity]


!! [{$pagename}] using [SASL]
This appears to be [Microsoft Windows] specific where all [communications] between [client] and [Server] will be [Digitally Signed] providing [Integrity] validation.
For [LDAP] [Clients] this is done using:
* The [signing key] is derived from the [authenticating|authentication] [Digital Identity]'s [Password-hash]
* The [client] calculates the [session Key]
* The [server] receives the [Session Key] from the [Domain Controller] in the [Netlogon service] [response]
An [Man-In-The-Middle] [attacker] with [Replay attack] capabilities has no way of retrieving the [session Key] and therefore will not be able to provide [Digitally Signed] [messages]

!! [Kerberos]
For [implementations] using [SPNEGO] or [GSSAPI], the [client] preforms the [Encryption] of the payload using a [Kerberos] [Session Key] before sending over the wire to [Microsoft Active Directory].

!! [LDAPS] and [StartTLS] [{$pagename}]
[Integrity] validation is part of the [Transport Layer Security] ([TLS]) protocol and is considered acceptable by [Microsoft Active Directory] as [{$pagename}]

!! Failed LDAP [Bind Request]
Windows [Domain Controllers] will return an event when [{$pagename}] is required and not used by the client on a NON-[Transport Layer Security] ([TLS]) connection similar to:

{{{LDAP error code 8 - server log [LDAP: error code 8 - 00002028: LdapErr: DSID-0C090202, comment: The server requires binds to turn on integrity checking if SSL\TLS are not already active on the connection, data 0, v2580 ]
}}}

Most Client should show a [LDAP Result Codes] of 8 indicating [LDAP_STRONG_AUTH_REQUIRED].

!! [{$pagename}] [Domain Controller] [Windows registry]
[HKEY_LOCAL_MACHINE]\SYSTEM\CurrentControlSet\Services\NTDS\Parameters under the value [LDAPServerIntegrity] (LDAPClientIntegrity for Clients):
* 0 - No signing/sealing
* 1 - Negotiate signing/sealing
* 2 - Require signing/sealing (Which is the advice of [ADV190023])

!! Configure [Microsoft Active Directory] and [AD LDS] diagnostic event [logging]
[LDAP] [Windows Security Log|Windows Security Log Event#section-Windows+Security+Log+Event-LDAPMicrosoftActiveDirectoryAndLDSDiagnosticEventLogging] must be at level 2 or higher to reveal these events:

There are several [Windows Security Log Events] to help indicate the status of implementation for [{$pagename}]:
* [Event 2886]
* [Event 2887]
* [Event 2888]
* [Event 2889]


!! More Information
There might be more information for this subject on one of the following:
[{ReferringPagesPlugin before='*' after='\n' }]
----
* [#1] - [Event ID 2886 — LDAP signing|https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941856(v=ws.10)?redirectedfrom=MSDN|target='_blank'] - based on information obtained 2020-01-18 
* [#2] - [LDAP signing|https://docs.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2008-R2-and-2008/dd941832(v=ws.10)?redirectedfrom=MSDN|target='_blank'] - based on information obtained 2020-01-18 
* [#3] - [Identifying Clear Text LDAP binds to your DC's|https://docs.microsoft.com/en-us/archive/blogs/russellt/identifying-clear-text-ldap-binds-to-your-dcs|target='_blank'] - based on information obtained 2020-01-18 
* [#4] - [Query-InsecureLDAPBinds.ps1|https://github.com/russelltomkins/Active-Directory/blob/master/Query-InsecureLDAPBinds.ps1|target='_blank'] - based on information obtained 2020-01-18 
* [#5] - [LDAP Signing Events Custom View.xml|https://github.com/russelltomkins/Active-Directory/blob/master/LDAP%20Signing%20Events%20Custom%20View.xml|target='_blank'] - based on information obtained 2020-01-18 
* [#6] - [The current Client Signing setting is maintained in the registry (of course) in the key|https://blog.joeware.net/2018/07/07/5842/|target='_blank'] - based on information obtained 2020-01-22 
* [#7] - [How to enable LDAP signing in Windows Server|Wikipedia:https://support.microsoft.com/en-us/help/935834/how-to-enable-ldap-signing-in-windows-server-2008|target='_blank'] - based on information obtained 2020-01-22