This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Do i need LDAP in my AD server for ad sync?

naveen palla 6 months ago

This thread was automatically locked due to age.

Top Replies

Rutvik Chavda 6 months ago +1

Hello, Naveen Palla , We appreciate your reaching out to the Sophos Community Forum. LDAP isn’t strictly required in your AD server for synchronization with Sophos, as AD itself uses LDAP as its…

0 Rutvik Chavda 6 months ago
Hello, Naveen Palla,

We appreciate your reaching out to the Sophos Community Forum.

LDAP isn’t strictly required in your AD server for synchronization with Sophos, as AD itself uses LDAP as its underlying protocol for directory access. However, if you're integrating Sophos with systems or applications that specifically rely on LDAP for authentication or directory queries, ensuring LDAP is properly configured in your AD server might be necessary.

The requirements depend on your specific setup and the systems you're integrating with Sophos.

Please refer to these articles for reference:

https://docs.sophos.com/central/Customer/help/en-us/PeopleAndDevices/DirectoryService/SetUpSynchronizationWithActiveDirectory/index.html

https://docs.sophos.com/central/Customer/help/en-us/PeopleAndDevices/DirectoryService/SetUpSynchronizationWithActiveDirectory/ADSyncFAQ/index.html

docs.sophos.com/.../index.html

Let me know if you need any further help.

Regards,
Regards,

Rutvik Chavda

Global Digital Endpoint Security Engineer

Are you a Sophos Partner? | Product Documentation | @SophosSupport | Sign up for SMS Alerts

If a post solves your question, please use the "Verify Answer" button.

The New Home of Sophos Support Videos! - Visit Sophos Techvids
- 0 naveen palla 6 months ago in reply to Rutvik Chavda
  
  strong authentication is required for this opeartion means?
  - 0 FormerMember 5 months ago in reply to naveen palla
    
    Hello naveen palla ,
    
    By any chance, are you trying to set this up on a Windows Server 2025 or Windows Server 2022 23H2 Domain Controller?
    
    If so, the "Strong Authentication is required for this operation" message could be due to changes in LDAP signing requests introduced in the 2022 23H2 and 2025 Server editions. The default AD configuration does not allow the ADSync tool to authenticate successfully in AD.
    
    To allow the ADSync tool to authenticate successfully in Active Directory, the LDAP security settings need to be adjusted as follows:
    
    Open the Domain Controller Policy editor.
    
    Go to Computer Configuration > Policies > Windows Settings > Security Settings >Local Policies > Security Options.
    
    Make the following changes:
    
    Domain controller: LDAP server channel binding token requirements: When Supported
    
    Domain controller: LDAP server signing requirements: None
    
    Domain controller: LDAP server Enforce signing requirements: Disabled
    
    Network security: LDAP client encryption requirements: Negotiate Sealing
    
    Network security: LDAP client signing requirements: Negotiate Signing
    
    This change will configure LDAP signing requests to the same default levels assigned to Windows Servers 2022.
    
    Let us know how it goes.