# Ensure 'Network security: LDAP client signing requirements' is set to 'Negotiate signing' or higher

Necessity: This setting determines the level of data signing required for LDAP requests initiated by the client. Unsigned network traffic is susceptible to man-in-the-middle (MitM) attacks, where an attacker can intercept and modify LDAP packets. By exploiting this, an attacker could escalate privileges by modifying queries and tricking a server into making security decisions based on forged data. Enforcing LDAP client signing mitigates this risk by ensuring the integrity and authenticity of the LDAP communication. Auditing and Remediation: The audit script checks the current configuration by reading the specific registry key that controls LDAP client signing. The remediation script modifies this same registry key to enforce the desired signing level, thereby securing LDAP communications against tampering. Recommended State Rationale: Basic: ['Negotiate signing'] ensures that clients will attempt to use a secure, signed connection if the server supports it, providing a baseline of protection while maintaining compatibility with older servers that may not support signing. Moderate & Strict: ['Require signing'] represents the most secure configuration. It mandates that all LDAP client traffic must be signed, and communication will fail if the server cannot comply. This eliminates the risk of downgrade attacks and ensures that data integrity is always maintained, which is the recommended practice for all modern environments.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['Negotiate signing']` |
| **Moderate** | `['Require signing']` |
| **Strict** | `['Require signing']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script to query the registry value at 'HKLM:\SYSTEM\CurrentControlSet\Services\ldap\LdapClientIntegrity'. The script must convert the numerical output to its corresponding string representation ('None', 'Negotiate signing', 'Require signing') and return only that string value.

## Remediation Script Working

PowerShell script that accepts a single positional command-line argument, which must be one of the following strings: 'None', 'Negotiate signing', or 'Require signing'. The script must translate this string to its corresponding numerical value (1, 2, or 3 respectively) and set the 'LdapClientIntegrity' REG_DWORD value at 'HKLM:\SYSTEM\CurrentControlSet\Services\ldap'. The script must return $true on success and $false on failure.

