Skip to main content
epinheiro
Staff
epinheiro
Staff
June 19, 2026

Troubleshooting Tip: Fixing LDAP and LDAPS connection issues with Windows Server 2025

  • June 19, 2026
  • 0 replies
  • 411 views

Description

This article describes how to resolve LDAP and LDAPS connection failures when integrating a FortiGate with a Windows Server 2025 directory.
A 'Strong(er) authentication required' warning might appear for LDAP on port 389, and 'Can't contact LDAP server' for LDAPS on port 636.

This guide explains how to bypass the 'Strong(er) authentication required' issue by adjusting Group Policy enforcement and outlines the manual steps to configure a secure certificate for LDAPS connections on Windows Server 2026.

Scope

FortiGate, Windows Server 2025.

Solution

Part 1: Adjusting Group Policy for LDAP/LDAPS Connections:

Microsoft introduced stricter default security postures in Windows Server 2025. Because of this, standard LDAP bind attempts are often blocked by the domain controller's native policy enforcement.

231d28b4.png


To establish a successful connection, the server's signing requirements must be adjusted to align with the chosen protocol and port.

  • Press Windows key + R to open the Run dialog.

  • Type 'gpedit.msc' and press Enter.

  • Navigate through the following path: Local Group Policy Editor -> Computer Configuration -> Windows Settings -> Security Settings -> Local Policies -> Security Options.

  • Locate the policy named Domain controller: LDAP server signing requirements.

  • The default state is 'Not Defined', which drops the connection.
    Modify this setting based on the target port:

    • For Secure LDAP (LDAPS) via port 636: Change the value to Enabled.

    • For standard LDAP via port 389: Change the value to Disabled.

  • Open Command Prompt as Administrator and execute 'gpupdate /force' to apply the new policy settings immediately.

Part 2: Manual Certificate Configuration for LDAPS on Windows Server 2025:

To use Secure LDAP (LDAPS) over port 636, the Domain Controller requires a valid certificate.
In older Windows Server versions, installing the AD CS role often triggered an automatic background certificate enrollment for the Domain Controller. Therefore, the only necessary step was importing the CA certificate into FortiGate.

691a9c29.png


In Windows Server 2025, this process typically requires a manual request for the Domain Controller Authentication certificate; however, importing this specific certificate to the FortiGate is not required.

If the FortiGate fails to negotiate LDAPS after completing Part 1, follow these steps to manually generate the required certificate:

  • On the Windows Server 2025 Domain Controller, open the Microsoft Management Console by pressing Windows key + R, typing 'mmc', and pressing Enter.

  • Go to File -> Add/Remove Snap-in, select Certificates, and select Add.

  • Select Computer account, select Next, choose Local computer, select Finish, and then OK.

  • Expand Certificates (Local Computer) -> Personal -> Certificates.

  • If the Domain Controller certificate is missing, right-mouse-select on the Certificates folder, select All Tasks -> Request New Certificate.

  • Select Next twice to reach the Request Certificates screen.

  • Check the box for Domain Controller Authentication.

  • Select Enroll.

  • Once the status shows 'Succeeded', select Finish. The newly generated certificate will now be listed in the Personal store.

Once the Domain Controller Authentication certificate is generated, the FortiGate can successfully integrate via LDAPS.

    Terms & ConditionsAccessibility statement