> Source: [sk164834](https://support.checkpoint.com/results/sk/sk164834)

# sk164834 - Quantum LDAPS support for Windows Server 2025  

| Property | Value |
|----------|-------|
| Solution ID | sk164834 |
| Date Created | 2020-01-22 |
| Last Modified | 2026-06-25 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20, R81.10 (EOS) |

## Symptoms

- * Identity Awareness Configuration Wizard fails with error message (ADV190023): "*Gateway could not connect to \[IP address\] - Credentials are valid but LDAP communication with the server failed*" 

  ![](https://sc1.checkpoint.com/sc/SolutionsStatics/sk164834/ida_wizard_2025202509150645131.png)
* The daemon debug file *$FWDIR/log/pdpd.elg*
  shows this message:  

  "*LdapErr: DSID-0C090257, comment: The server requires binds to turn on integrity checking if SSL\\TLS are not already active on the connection*"

* When running the `test_ad_connectivity` tool ([sk100406](https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&solutionid=sk100406)) on the Security Gateway without the `-s` parameter, the command hangs, and *$FWDIR/log/test_ad_connectivity.elg* shows this error:  

  "*an error occurred while binding to ldap server: Strong(er) authentication required*".

* **Failed Log In** logs appear in SmartConsole with one of these descriptions:  

  * "*An error was detected while trying to authenticate against the AD server. It may be a problem of bad configuration or connectivity. Please refer to the troubleshooting guide for more help*"
  * "*Unknown user*"
  * "*User's FireWall-1 password malformed*"
  .
  * This error shows:  

    "*LdapErr: DSID-0C090257, comment: The server requires binds to turn on integrity checking if SSL\\TLS are not already active on the connection* " after running these debug commands on the Security Gateway:


    * For Identity Awareness:  
      `pdp debug set CPLDAPCL all`  
      Debug files: *$FWDIR/log/pdpd.elg\**

    * For Remote Access VPN:  
      `ike debug trunc ALL=5`  
      Debug files: *$FWDIR/log/iked.elg\**

    * For Mobile Access blade:  
      `cvpnd_admin debug set TDERROR_ALL_ALL=5`  
      Debug files: *$CVPNDIR/log/cvpnd.elg\**

    For VSX environments, the administrator ran this command before running the debug command:  

    `vsenv #`, Where # is the relevant VS number - relevant for VSX machine only.
  * When running this command on the Security Gateway in Expert mode:  

    `ldapsearch -h domain.controller.ip.address -p 389 -D distinguished,name,of,user -w password -b "dc=domain,dc=suffix" "(objectClass=dummy)"`  

    This error shows:  

    *"(Strong(er) authentication required)"*.

## Cause

Microsoft added an option to apply new security settings at the beginning of 2020 - LDAP Channel Binding and LDAP Signing for Windows. For more information, refer to:

* <https://learn.microsoft.com/en-us/windows-server/get-started/whats-new-windows-server-2025#active-directory-domain-services>
* <https://support.microsoft.com/en-us/help/4520412/2020-ldap-channel-binding-and-ldap-signing-requirement-for-windows>
* <https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/ADV190023>

The change affects setups that use LDAP, and not LDAPS (LDAP over SSL).

**There is no impact on setups that already use LDAPS.**

## Solution

1. In the Identity Awareness Wizard, when you receive a connection error:
   1. Select **Ignore the errors and continue to configure the LDAP account**.
   2. Click **Finish**.
2. In SmartConsole, go to the **Object Explorer** , in the **LDAP Account Unit** object that you create or edit, go to the **Servers** tab \> **Encryption** .Configure LDAPSaccording to the procedure in the Quantum Security Management Guide for your version \> [Account Units](https://sc1.checkpoint.com/documents/R82/WebAdminGuides/EN/CP_R82_SecurityManagement_AdminGuide/Content/Topics-SECMG/Account-Units.htm?Highlight=account%20units) section \> Servers.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content