Techie2000 Posted October 18, 2019 Posted October 18, 2019 Hi all, I'm looking to configure and enable LDAPS on my domain controllers, purely to save me the constant phone calls during holiday times by allowing self-service password resets via Foldr. I'm looking to enable it within an existing domain which has been running for around 2/3 years without LDAPS being enabled. Is there anything I should do before hand/ be prepared for? As you can probably tell this is something I haven't enabled previously, so I'm treading carefully!
Norphy Posted October 18, 2019 Posted October 18, 2019 It isn’t difficult. Ideally you should get publicly trusted SSL certificates, especially if the service that’s using it is an external one but you might be able to get away with certificates issued by an internal CA if your only going to use internal services and if that service trusts your root CA. Once you’ve got your cert, it’s recommended to put it into the DC’s NTDS personal certificate store. You can put it into the computers if you prefer but it’s better in the NTDS one. One thing, if you’re going to use a public cert, you will needs domain name that uses a routable domain name as most public CAs won’t issue cert’s to .internal, .local and the like any more. 1
Chuckster Posted December 9, 2019 Posted December 9, 2019 Hi all, I'm looking to configure and enable LDAPS on my domain controllers, purely to save me the constant phone calls during holiday times by allowing self-service password resets via Foldr. I'm looking to enable it within an existing domain which has been running for around 2/3 years without LDAPS being enabled. Is there anything I should do before hand/ be prepared for? As you can probably tell this is something I haven't enabled previously, so I'm treading carefully! Hi @Techie2000, is there any particular guide you followed to enable LDAPS?
Techie2000 Posted December 9, 2019 Author Posted December 9, 2019 I didn't do it in the end! I thought I'd try and opt to setup password sets via O365 dirsync instead and that didn't work either. Was just really a case to save me getting emails to manually reset passwords but so far no luck, sorry
mavhc Posted January 29, 2020 Posted January 29, 2020 Install AD Certificate services, set up as enterprise, done. (Unless you have loads of Windows Servers and want to not put it on a DC, then read the instructions) Make sure you use sha256 not sha1, it's 255 better. Test with ldp.exe, connect using domain name, not ip
Norphy Posted January 29, 2020 Posted January 29, 2020 Install AD Certificate services, set up as enterprise, done. (Unless you have loads of Windows Servers and want to not put it on a DC, then read the instructions) Make sure you use sha256 not sha1, it's 255 better. Test with ldp.exe, connect using domain name, not ip That's only of use if you are internal services. If you are using an external service to connect via LDAPS, they will expect a publicly signed certificate and it's not always possible or reasonable to ask them to ignore untrusted certs. And to preempt your usual response to things like this, yes, I know, everything should use OAUTH but that's not always an option and switching over to a service that supports it isn't always an option either.
FragglePete Posted January 29, 2020 Posted January 29, 2020 Doing the same - trying get my head around getting LDAPS up and running but with the pending change coming in March, gotta get it sorted. I'm using this to help: https://www.starwindsoftware.com/blog/using-the-microsoft-certificate-authority-to-get-rid-of-those-self-signed-certs Pete
mavhc Posted January 29, 2020 Posted January 29, 2020 Generally you need both, you need internal CA for internal devices, and if you want external connections that can't use your CA, a signed cert. If you just want to run the CA on your DC it's almost too simple, install it, done. The CA root cert is sent to the domain joined computers automatically too.
buzzard Posted January 29, 2020 Posted January 29, 2020 I always use the method detailed here - https://www.digicert.com/ssl-certificate-installation-microsoft-active-directory-ldap-2012.htm If you're using other certs from other CA's just miss out the Digicert tool sections and use alternative methods
FragglePete Posted January 29, 2020 Posted January 29, 2020 If you just want to run the CA on your DC it's almost too simple, install it, done. The CA root cert is sent to the domain joined computers automatically too. Does it have to be on a DC? My understanding it could be a member server. I'm playing with my test setup first, small little Domain on an old server, I've got a Domain all setup and installed the CA on a member server but the Enterprise CA is greyed out. Am I missing something? Pete
FragglePete Posted January 29, 2020 Posted January 29, 2020 Ignore me - The account I used wasn't Enterprise Admin and Schema Admin. Amended. Enterprise CA is available to me. Pete
mavhc Posted January 29, 2020 Posted January 29, 2020 It's just really simple if it's on the DC. Otherwise you set up templates and configure domain computers to auto request certs https://www.virtuallyboring.com/setup-microsoft-active-directory-certificate-services-ad-cs/ 2
FragglePete Posted January 29, 2020 Posted January 29, 2020 It's just really simple if it's on the DC. Otherwise you set up templates and configure domain computers to auto request certs https://www.virtuallyboring.com/setup-microsoft-active-directory-certificate-services-ad-cs/ Appreciate the link - most helpful. Agree with what your saying, but like to keep the DCs just being DCs - makes things easier when doing upgrades, etc. Again, many thanks. Pete
Primus Posted January 29, 2020 Posted January 29, 2020 If you install a CA on a DC and you ever need to demote it to replace it etc. you have made the job more complicated as you will need to move the CA first. Virtualisation allows for separation of roles - it's best practice for a reason. 2
mavhc Posted January 29, 2020 Posted January 29, 2020 Isn't best practise containers now? Either way, requires more licences than I have. Why would you need to replace it, it's virtual.
free780 Posted January 29, 2020 Posted January 29, 2020 Don't put a CA on a DC in production. You will be in a world of pain if you need to move it or your CRL is on the DC. 1
Domino Posted January 29, 2020 Posted January 29, 2020 Isn't best practise containers now? Either way, requires more licences than I have. Why would you need to replace it, it's virtual. Windows Server Roles aren't suitable for containerization...and you'll need to replace it when the OS is out of support. Member servers rather than DCs will save you pain later - if you want to do it *properly* you'd also have an offline CA with online subordinate signing server. This vastly reduces the pain of redeployment if Root Keys are ever compromised.
timbo343 Posted January 29, 2020 Posted January 29, 2020 Im in the same boat at the moment and starting to get a bit too deep - i hate certs the best of times. Originally a CA role was installed on a DC. I was told that if i didnt use the CA it could be removed so i did. About 10 years later i re-setup 2 servers which are currently turned off for CAs.
mavhc Posted January 30, 2020 Posted January 30, 2020 If people cared enough to set up pki properly they wouldn't be in this thread. So, install DC, install ADCS on DC, wait 10 years, install it again on a new server OS version. Or: Install DC, install MS, install ADCS on MS, wait 10 years, install it again on a new server OS version. Can't see the difference, except another £250 for another copy of Windows server
Norphy Posted January 30, 2020 Posted January 30, 2020 Can't see the difference, except another £250 for another copy of Windows server Sure, if you're installing it on another physical host. Otherwise, if you've got any sense, you've got a Windows Datacenter license which gives you unlimited VM guests on your host. Which I suspect you know, I'd be surprised if you didn't. Even if you're using Standard licenses, you can install two VMs on top of the host on the same license. 1
mavhc Posted January 30, 2020 Posted January 30, 2020 Sure, if you're installing it on another physical host. Otherwise, if you've got any sense, you've got a Windows Datacenter license which gives you unlimited VM guests on your host. Which I suspect you know, I'd be surprised if you didn't. Even if you're using Standard licenses, you can install two VMs on top of the host on the same license. That's £1500, no way I'd be getting that, nor could I see the point of running over 12 Windows VMs on one host.
mavhc Posted January 30, 2020 Posted January 30, 2020 So over 6 years same cost, although it EOLs in 9 years, so cheaper to buy outright
3s-gtech Posted January 30, 2020 Posted January 30, 2020 You wouldn't be expected to run the same version for nine years though - normally it's three. Don't be obtuse for the sake of a poorly made point. It is a very cheap way to run multiple VMs. 1
mavhc Posted January 30, 2020 Posted January 30, 2020 Yeah, no one's running Windows 2008 R2 still, that's not a thread. My aim is always to give the least amount of money possible to Microsoft
Recommended Posts
Create an account or sign in to comment
You need to be a member in order to leave a comment
Create an account
Sign up for a new account in our community. It's easy!
Register a new accountSign in
Already have an account? Sign in here.
Sign In Now