Warnung 2886 auf SBS2008: Sicherheit auf dem Server

[aba101280 10]

Hallo Zusammen,

 

nachdem ich bis gestern Abend erfolgreich (hoffe ich zumindest :-) ) meinen ersten SBS 2008 Server aufgesetzt habe, hätte ich eine Frage zur EventID 2886. Diese bekomme ich einmal am Tag in den ActiveDirectory und Domain Services.

 

"The security of this directory server can be significantly enhanced by configuring the server to reject SASL (Negotiate, Kerberos, NTLM, or Digest) LDAP binds that do not request signing (integrity verification) and LDAP simple binds that are performed on a cleartext (non-SSL/TLS-encrypted) connection. Even if no clients are using such binds, configuring the server to reject them will improve the security of this server.

 

Some clients may currently be relying on unsigned SASL binds or LDAP simple binds over a non-SSL/TLS connection, and will stop working if this configuration change is made. To assist in identifying these clients, if such binds occur this directory server will log a summary event once every 24 hours indicating how many such binds occurred. You are encouraged to configure those clients to not use such binds. Once no such events are observed for an extended period, it is recommended that you configure the server to reject such binds.

 

For more details and information on how to make this configuration change to the server, please see How to enable LDAP signing in Windows Server 2008.

 

You can enable additional logging to log an event each time a client makes such a bind, including information on which client made the bind. To do so, please raise the setting for the "LDAP Interface Events" event logging category to level 2 or higher."

 

 

Ich hab nun schon etwas länger recherchiert und das einzige was ich gefunden habe ist ein Tipp im EventID net, welcher sagt dass ich diese Gruppenrichtlinie verändern soll:

 

"The two GPOs to configure to remove this warning are:

 

- Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Network Security: LDAP client signing requirements = negotiate signing.

 

- Computer Configuration -> Policies -> Windows Settings -> Security Settings -> Local Policies -> Security Options -> Domain controller: LDAP server signing requirements = require signing."

 

Mal abgesehen davon dass ich nicht ganz verstehe was es für Auswirkungen hat, ist die zweite Richtline auf None und ausgegraut. Lässt sich also nicht verändern.

 

Kann jemand helfen?

 

Danke und Grüße

 

Alex