41
Domain controller: LDAP server signing requirements
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Not Defined
Not Defined
Not Defined
Require Signing
Important:
If all domain controllers are running Windows 2000 or later, set this security option to
Require signing.
Otherwise, leave this setting as
Not Defined.
Since all computers in the High Security
environment are running either Windows 2000 or Windows Server 2003, this setting is configured to
require signing
for this environment.
The
Domain controller: LDAP server signing requirements
security option setting determines whether
the LDAP server requires signing to negotiate with LDAP clients. Network traffic that is neither signed
nor encrypted is susceptible to man-in-the-middle attacks in which an intruder captures packets
between the server and the client and modifies them before forwarding them to the client. In the case
of an LDAP server, this means that an attacker could cause a client to make decisions based on false
records from the LDAP directory.
Domain controller: Refuse machine account password changes
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Not
Defined
Disabled Disabled Disabled
The
Domain controller: Refuse machine account password changes
security option setting determines
whether domain controllers will refuse requests from member computers to change computer account
passwords. Enabling this setting on all domain controllers in a domain prevents computer account
passwords on domain members from changing, leaving them susceptible to attack. Therefore, the
value for this security option is set to
Disabled
in the three environments defined in this guide.
Domain member: Digitally encrypt or sign secure channel data (always)
Member Server Default
Legacy Client
Enterprise Client
High Security Client
Enabled Disabled Disabled Enabled
Important:
In order to take advantage of this security option setting on member workstations and
servers, all domain controllers that constitute the member’s domain must be running Windows NT 4.0
with Service Pack 6a or later; this is not supported in Windows 98 Second Edition clients (unless they
have the dsclient installed). This setting must be set to
Disabled
for HP NAS server systems within
multi-protocol network environments involving NFS, AFTP, or NCP.
The
Domain member: Digitally encrypt or sign secure channel data (always)
security option setting
determines whether all secure channel traffic initiated by the domain member must be signed or
encrypted. If a system is set to always encrypt or sign secure channel data, then it cannot establish a
secure channel with a domain controller that is not capable of signing or encrypting all secure
channel traffic, because all secure channel data is signed and encrypted. This security option to
Disabled
in the Legacy Client and Enterprise Client environments and it is configured to
Enabled
in the
High Security environment.
