.png?width=100&auto=webp&quality=80&disable=upscale "Picture of John Savill")
.png?width=400&auto=webp&quality=80&disable=upscale "John Savill")
Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
How can I enable anonymous Lightweight Directory Access Protocol (LDAP) connections under Windows Server 2003?
John Savill
May 31, 2005
1 Min Read
A. By default, connections to Active Directory (AD) must bind via a set of credentials so that they can perform a meaningful directory search. If you have applications that can't authenticate, you can enable anonymous LDAP connections. To do so, perform these steps:
Start adsiedit.msc, which is part of the Windows 2000 or later support tools. (Start, Run, adsiedit.msc).
Expand the Configuration container. Expand Services - Windows NT.
Right-click "CN=Directory Service" and select Properties.
Double-click the dSHeuristics attribute.
If the value is Not Set, set it to 0000002. If the value field isn't blank, change the seventh character of the string to 2 (e.g., if the value is 001, you'd change it to 0010002). Click OK.
Close ADSI Edit.
After the change has replicated to all domain controllers (DCs), Windows 2003 will allow anonymous LDAP connections. However, ACLs on the data in AD still apply, so to let anonymous users view objects, you need to grant them Anonymous logon access rights. For example, to let anonymous users view an OU's contents, grant "Anonymous logon" the List Contents right.
About the Author
You May Also Like
.jpg?width=700&auto=webp&quality=80&disable=upscale)
