Ruckus AD Authentication after Windows server 2025

[Badaz52]

Hi Everyone,

 

We are having issues with Ruckus AD authentication after upgrading our DCs to Windows Server 2025. The error we receive is admin invalid, I've had a look through various google search results and knowledge base articles and I can't find anything which says what this error actually means. Has anyone else encountered this? All admin details and AD details are exactly the same as before.

[AdamD_Net-Ctrl]

Hello,

 

I think LDAP gets disabled with server 2025 and you can only bind using LDAPs.

 

Is this to login to the controller or for auth to an SSID?

 

Adam

[Badaz52]

7 minutes ago, AdamD_Net-Ctrl said:

Hello,

 

I think LDAP gets disabled with server 2025 and you can only bind using LDAPs.

 

Is this to login to the controller or for auth to an SSID?

 

Adam

Just auth to an SSID. We use a local login for the unleashed controller.

[AdamD_Net-Ctrl]

Just now, Badaz52 said:

Just auth to an SSID. We use a local login for the unleashed controller.

Ok, I am guessing its a web auth ssid, I think its how sever 2025 works with LDAP

 

Edit this on your domain controller policy:

Domain Controller Policy
===Computer Configuration
======Policies
=========Windows Settings
============Security Settings
===============Local Policies
==================Security Options
=====================Domain controller: LDAP server channel binding token requirements: "When Supported"
=====================Domain controller: LDAP server signing requirements: "None"
=====================Domain controller: LDAP server Enforce signing requirements: "Disabled"
=====================Network security: LDAP client encryption requirements: "Negotiate Sealing"
=====================Network security: LDAP client signing requirements: "Negotiate Signing"

 

 

 

[willtech]

You might be able to disable the signing requirement: How to enable LDAP signing - Windows Server | Microsoft Learn but where possible I would use signed. You may also need to check local group policy to ensure the change kicks in. 

[Davit2005]

Should not need a admin account for LDAP/LDAPS auth, a bog standard Domain User account should be enough (certainly with the many services I have setup that use LDAP/S), I'd create a specific AD service account for it too and name appropriately so you know if you change password it will only be one thing effected.

 

Some devices can also be a bit of a mare to setup LDAPS, one of our devices we have to add an intermediate cert that is used on our LDAPS otherwise auth does not work

Edited April 13 by Davit2005