Goal
The AD/LDAP Connection Check Tool is a diagnostic utility for validating and troubleshooting LDAP/LDAPS connectivity between Netwrix Password Secure and Microsoft Active Directory. It replicates the connection and authentication logic Password Secure uses when establishing a directory connection, and produces detailed technical logs for Support analysis.
Prerequisites
- Windows operating system
- Network connectivity to at least one Domain Controller
- Firewall rules allowing the required ports (389 for LDAP, 636 for LDAPS)
- Valid service account credentials
- LDAPS certificate installed on the Domain Controller (if using SSL)
Support use only: Run this tool only when explicitly instructed by Netwrix Support — it is not intended for general administrative use or independent configuration changes, and it does not modify Active Directory objects, change domain configuration, store credentials, or replace production configuration in Password Secure. Do not distribute its logs publicly (e.g. in the community forum), as they may contain infrastructure details.
Steps
- Test with the Secure flag only, to validate basic LDAP connectivity (port 389).
- Add the SecureSocketsLayer flag to validate LDAPS (port 636), if your environment requires encrypted transport.
- Add Signing and Sealing if your domain's security policies enforce LDAP signing.
- Provide the full log output to Netwrix Support for analysis. Do not change production Password Secure settings unless directed to by Support.
Reference for the authentication flags used above:
| Flag | Technical meaning | Typical scenario |
|---|---|---|
| Secure | Uses NTLM or Kerberos authentication | Standard domain authentication |
| SecureSocketsLayer | Enables LDAPS (SSL/TLS, TCP 636) | Encrypted LDAP transport |
| Signing | Digitally signs LDAP traffic | Required when LDAP signing is enforced |
| Sealing | Encrypts LDAP session data | Required in hardened environments |
| Encryption | Requests encryption at the provider level | Used in secure communication contexts |
- SecureSocketsLayer requires a valid certificate on the Domain Controller.
- LDAP signing policies may require both Signing and Sealing.
- Incorrect flag combinations can cause bind failures.
Interpreting the tool's output — if the connection check fails, match the error code to one of the following:
- 0x8007203A ("The server is not operational"): Domain Controller unreachable, DNS resolution failure, firewall blocking LDAP/LDAPS ports, invalid SSL certificate (LDAPS), or an incorrect domain name.
- 0x8007052E (logon failure): Invalid username or password, account locked or expired, or incorrect username format.
- Strong authentication required: The domain enforces LDAP signing but the Signing or Sealing flag is missing, or the SSL configuration is incompatible.