I have an error that shows every day on my Active Directory Server
Log Name: Directory Service
Source: Microsoft-Windows-ActiveDirectory_DomainService
Date: 8/25/2015 8:43:54 PM
Event ID: 2887
Task Category: LDAP Interface
Level: Warning
Keywords: Classic
User: ANONYMOUS LOGON
Computer: NGFS1.guzmor.local
Description:
During the previous 24 hour period, some clients attempted to perform LDAP binds that were either:
(1) A SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP bind that did not request signing (integrity validation), or
(2) A LDAP simple bind that was performed on a cleartext (non-SSL/TLS-encrypted) connection
This directory server is not currently configured to reject such binds. The security of this directory server can be significantly enhanced by configuring the server to reject such binds. For more details and information on how to make this configuration
change to the server, please see http://go.microsoft.com/fwlink/?LinkID=87923.
Summary information on the number of these binds received within the past 24 hours is below.
You can enable additional logging to log an event each time a client makes such a bind, including information on which client made the bind. To do so, please raise the setting for the "LDAP Interface Events" event logging category to level 2
or higher.
Number of simple binds performed without SSL/TLS: 2
Number of Negotiate/Kerberos/NTLM/Digest binds performed without signing: 0
Event Xml:
<Event xmlns="http://schemas.microsoft.com/win/2004/08/events/event">
<System>
<Provider Name="Microsoft-Windows-ActiveDirectory_DomainService" Guid="{0e8478c5-3605-4e8c-8497-1e730c959516}" EventSourceName="NTDS LDAP" />
<EventID Qualifiers="32768">2887</EventID>
<Version>0</Version>
<Level>3</Level>
<Task>16</Task>
<Opcode>0</Opcode>
<Keywords>0x8080000000000000</Keywords>
<TimeCreated SystemTime="2015-08-26T03:43:54.003849000Z" />
<EventRecordID>3613</EventRecordID>
<Correlation />
<Execution ProcessID="620" ThreadID="788" />
<Channel>Directory Service</Channel>
<Computer>NGFS1.guzmor.local</Computer>
<Security UserID="S-1-5-7" />
</System>
<EventData>
<Data>2</Data>
<Data>0</Data>
</EventData>
</Event>
Since this started to show, some of my computers show an error when trying to log in.
The trust relationship between this workstation and the primary domain failed.
And some mapped drives fail to connect.
- Edited by Ignacio B. Rivas Wednesday, August 26, 2015 5:31 PM
Other recent topics
