What I am trying to do

For reasons I may not go into, we must allow Anonymous Bind in AD on a private network. I am fully aware of the risks associated with this. I have found a myriad of documentation around enabling and disabling anonymous bind.

What I have tried

Nothing. I have not been able to find anything around limiting what data is exposed in AD in anonymous bind. Has anyone gone trough the exercise of limiting information that is disclosed when using Anonymous Bind in Active Directory? I would like to at least minimize what data is provided via anonymous bind queries.

  • Have you considered running an AD LDS instance to satisfy your requirement? Only necessary information would be replicated thus greatly minimizing potential exposure. The "why" is helpful since there maybe an alternative solution. – user2320464 Aug 19 '17 at 4:08

Rather than enabling anonymous AD bind consider using LDAP or perhaps a Read-only domain controller (RODC).

Using either of these should allow you to expose limited information without direct access to the upstream AD.

If you really have to enable Anonymous AD bind then use permissions to specify the access the "Anonymous Logon" user has to objects. Use a whitelist approach to specific objects rather than a blacklist approach.

It's worth mentioning although you're on a "private" network there could be threats on the network from either those malicious users legitimately on the network or from compromised hosts.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.