# Ensure 'Network security: LDAP client signing requirements' is set to 'Negotiate signing' or higher

Necessity: This setting determines the level of data signing required for LDAP clients. Unsigned LDAP network traffic is susceptible to man-in-the-middle (MITM) attacks, where an intruder captures packets between the client and the server and modifies them before forwarding them to the server. This could lead to a server making decisions based on false or altered data from the LDAP query, potentially resulting in privilege escalation or unauthorized access. Enforcing LDAP client signing mitigates this risk by ensuring the integrity of the data packets.

Auditing and Remediation: The audit script checks the current configuration by reading the 'LDAPClientIntegrity' DWORD value from the registry. The remediation script modifies this same registry value to enforce the desired level of LDAP client signing.

Recommended State Rationale:
- Basic: ['1'] (Negotiate signing). This is the minimum security recommendation. The client requests data signing, but a session can still be established if the server does not support it. This provides protection against MITM attacks when communicating with servers that support signing, but maintains compatibility with older servers.
- Moderate: ['2'] (Require signing). This state provides a higher level of security by mandating that LDAP signing must be used for the communication to succeed. If the server does not support LDAP signing, the communication will fail. This is the recommended state for most environments.
- Strict: ['2'] (Require signing). This is the most secure setting and is identical to the moderate recommendation, as there is no higher level of security for this specific policy. It completely eliminates the risk of MITM attacks on LDAP traffic from this client and should be used in all environments where it is confirmed that all LDAP servers support signing.

## Recommended State Configuration

| Security Level | Value |
|----------------|-------|
| **Basic** | `['1']` |
| **Moderate** | `['2']` |
| **Strict** | `['2']` |
| **Type** | `ENUM` |

## Audit Script Working

PowerShell script that queries the registry value 'LDAPClientIntegrity' at the path 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa'. The script must return only the raw DWORD value, which can be 0 (None), 1 (Negotiate signing), or 2 (Require signing). If the value does not exist, the script should return '1', which is the system default.

## Remediation Script Working

PowerShell script that accepts a single positional integer argument (0, 1, or 2). The script must set the registry DWORD value 'LDAPClientIntegrity' at 'HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa' to the provided argument. The script must return '$true' on success and '$false' on failure.

