Strong(er) authentication required

Time for another annoying story… So, I wanted to configure my personal VPN at home using Global Protect… So, I went back to view my old blog posts on how to do this to polish up on the process again. And low and behold on following Step one, authentication I already hit a new road block. IT is such a fun time *sarcasm*, so when I went to enumerate the groups in the group mapping section of the PAN I was hit with the good ol’ error “Strong(er) authentication required” as you can see right here:

Looking this up online I found a Reddit post linking to a PAN KB. Which states this happens when you have LDAP hardening enabled, at least for older Windows Server (2008 referenced), when I wrote my old blog post I was running 2016, and I had updated it to 2022. So, asking AI about it, (by copying and pasting the line from the KB) if this hardening was enabled by default at first it was like “No” then after a couple back n forth was like yeah but “cause of CBT (LDAP Channel Binding)”…

Classic pedantic AI… So… what are my options?

Option 1) Disable CBT LDAP Channel Binding

The “not recommended option”

Registry Path

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

Value Name

LdapEnforceChannelBinding

Value Type

REG_DWORD

Possible Values

• 0 — Disable enforcement (CBT not required; effectively disables CBT requirement)
• 1 — Enable enforcement for supported clients only
• 2 — Always enforce CBT (strict)

To disable CBT enforcement, set:

LdapEnforceChannelBinding = 0

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters

(REG_DWORD)

LDAPServerIntegrity

Option 2) LDAPS

This is the more annoying but secure option.

1. Plan the certificate setup

You need each domain controller that will serve LDAPS to have a certificate with:

• Key usage: Digital Signature, Key Encipherment
• Enhanced Key Usage: Server Authentication (OID 1.3.6.1.5.5.7.3.1)
• Subject / SAN: Includes the DC’s FQDN (e.g. dc01.contoso.com)

You can use:

• Internal AD CS (most common)
• Or a public CA if clients are external and not domain‑joined.

2. Install Certificate Authority (if you don’t already have one)

Setup Offline Root CA (Part 1) – Zewwy’s Info Tech Talks

Remove Existing Enterprise Root CA (Part 2) – Zewwy’s Info Tech Talks

Setup Subordinate CA (Part 3) – Zewwy’s Info Tech Talks

Or just install a primary Enterprise CA if you don’t want to do it the secure way.

3. Create a certificate template for domain controllers (optional but recommended)

On the CA:

1. Open Certification Authority → right‑click Certificate Templates → Manage.
2. Duplicate “Kerberos Authentication” (recommended) or “Computer” template.
3. On the new template:
   • General: Give it a name like “Domain Controller LDAPS”.
   • Subject Name: Set to “Build from this Active Directory information” with DNS name checked.
   • Extensions: Confirm Server Authentication is present in EKU.
     I removed Smart card, and Client Auth.
4. Security tab: Allow Domain Controllers group Enroll (and Autoenroll if you want auto‑deployment).
5. Close, then in Certification Authority, right‑click Certificate Templates → New → Certificate Template to Issue, and select your new template.

4. Enroll the certificate on the domain controller

On each DC:

1. Open mmc.exe → File → Add/Remove Snap-in → add Certificates for Computer account.
2. Navigate to Personal → Certificates.
3. Right‑click Personal → All Tasks → Request New Certificate.
4. Choose your “Domain Controller LDAPS” (or equivalent) template → Enroll.
5. Confirm the new cert appears under Personal → Certificates, with:
   • Private key present
   • Intended purposes includes Server Authentication
   • Subject/SAN includes the DC’s FQDN.

*Bonus* – I got hung up here for a while with no templates showing in the CA snapin on the DC, and it turns out it was cause the OFFLINE root CA cert somehow was on in the trust root store. I’m have no idea how that happened, but yeah… shrug….

5. Verify LDAPS is active on port 636

On the DC:

1. Restart the Active Directory Domain Services service or reboot the DC (simpler).
2. Use ldp.exe (built‑in tool):
   • Run ldp.exe.
   • Connection → Connect…
   • Server: DC FQDN, Port: 636, check SSL → OK.
   • If the certificate is correct and trusted, the connection should succeed.

6. Import the Offline Root and SubCA Certs into PAN Firewall

I’ll finish this blog soon, but this covers most of the needful. lol