Sorry, I Don't know on the legacy way(389). Maybe others do? Maybe @Mads Petersen or @c4rm0
m
Mads Petersen
11/07/2023, 1:50 PM
LDAP requires the connection to be encrypted to allow password change, if you want to run it over 389, you will run LDAP over TLS.
r
Ray Davis
11/07/2023, 1:51 PM
Thanks, Mads. That makes sense.
m
Mads Petersen
11/07/2023, 1:54 PM
I don't think there is any changes on the DC compared to run it over SSL (636 vs 389 for starttls)
in my own test environment, i've just added the CA role and it worked out of the box, after the DC got the certificates.
r
Ryan Gallier
11/07/2023, 7:15 PM
you can also make a self signed and add it to the NTDS\Personal store