<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# LDAP Security Auditing — API Reference

## ldapsearch Commands

```bash
# Test anonymous bind
ldapsearch -x -H ldap://DC_IP -b "" -s base namingContexts

# Enumerate domain users
ldapsearch -x -H ldap://DC_IP -D "user@domain" -w "pass" -b "DC=target,DC=com" "(objectClass=user)" sAMAccountName

# Find Domain Admins
ldapsearch -x -H ldap://DC_IP -D "user@domain" -w "pass" -b "DC=target,DC=com" "(&(objectClass=group)(cn=Domain Admins))" member

# Password policy
ldapsearch -x -H ldap://DC_IP -D "user@domain" -w "pass" -b "DC=target,DC=com" "(objectClass=domainDNS)" pwdProperties minPwdLength

# LDAPS test
ldapsearch -x -H ldaps://DC_IP -D "user@domain" -w "pass" -b "DC=target,DC=com" "(cn=test)"
```

## Impacket Commands

```bash
# NTLM relay to LDAP
impacket-ntlmrelayx -t ldap://DC_IP --escalate-user attacker

# LDAP enumeration
impacket-GetADUsers target.com/user:password -all -dc-ip DC_IP

# Computer enumeration via LDAP
impacket-GetADComputers target.com/user:password -dc-ip DC_IP
```

## Python ldap3 Library

```python
from ldap3 import Server, Connection, ALL, SUBTREE

# Connect with TLS
server = Server('ldaps://DC_IP', get_info=ALL)
conn = Connection(server, 'user@target.com', 'password', auto_bind=True)

# Search
conn.search('DC=target,DC=com', '(objectClass=user)',
            attributes=['sAMAccountName', 'memberOf'])

# Check anonymous
conn = Connection(server, auto_bind=True)
conn.search('', '(objectClass=*)', search_scope='BASE',
            attributes=['namingContexts'])
```

## Registry Settings (Domain Controller)

| Setting | Path | Recommended Value |
|---------|------|-------------------|
| LDAP Signing | `HKLM\System\CCS\Services\NTDS\Parameters\LDAPServerIntegrity` | 2 (Required) |
| Channel Binding | `HKLM\System\CCS\Services\NTDS\Parameters\LdapEnforceChannelBinding` | 2 (Required) |

## Event IDs

| Event ID | Description | Source |
|----------|-------------|--------|
| 2886 | LDAP signing not required (warning) | Directory Service |
| 2887 | Unsigned LDAP binds count | Directory Service |
| 2889 | Individual unsigned LDAP bind | Directory Service |
| 3039 | LDAP channel binding not enforced | Directory Service |
