The cloud is not your only option: on-prem security still alive and well in Windows Server 2025

We’ve often heard that on-premises solutions are on their way out, but until it’s clear that being completely in the cloud makes sense, we will remain in a long transition period. Nowhere else is this made more evident than in the new security features of Windows Server 2025.While many of these features showcase a “cloud first” viewpoint, there are also clear indications that such technologies are here to stay, a case in point is Microsoft’s Active Directory, which is still supported and is in fact getting some enhancements.As with many technologies, these features and enhancements kick in after you have ensured that you have raised the forest level and made certain changes in your domain. For example, one of the new changes in Active Directory security surrounds mandatory Lightweight Directory Access Protocol (LDAP) encryption for all connections, protecting sensitive directory data from eavesdropping and tampering.LDAP has long been used and abused by users and attackers alike. A line of business application will often rely on LDAP for its authentication processes, exposing a means for an attacker to perform injection attacks and other queries.We’ve often been told to ensure that our network enforces LDAP signing, but that isn’t the same process as encryption or turning on LDAPs, as this encrypts all LDAP attributes including user credentials. Microsoft has been wanting us to turn this setting on since 2007 and Server 2008. Now with Server 2025 they are enabling the setting by default, it can be turned off if you have an older application that won’t support it.Server 2025 will be supporting TLS 1.3, the latest version of transport layer security, in LDAP over TLS connections. This is not a new technology, but a setting that will now be strongly recommended. The implementation of TLS 1.3 when using LDAP over SSL or using the StartTLS command was first supported on platforms starting in June of 2022. Windows updates KB5014668 and KB5014665 specifically add support for this security setting to Windows 11 and Server 2022. If you have these platforms now you can enable this with the following settings:LDAP server sideUse Registry Editor to modify the following values to disable or re-enable TLS 1.3 LDAP) on the server side:Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\ParametersRegistry value: LdapDisableTLS1.3Value type: REG_DWORDValue data: 0 (Default Enabled) / 1 (Disabled)Restart the Active Directory Domain Services service for the setting to be effective.LDAP client sideUse Registry Editor to modify the following values to disable or re-enable TLS 1.3 for LDAP on the client side:Registry key: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\LDAPRegistry value: DisableTLS1.3Value type: REG_DWORDValue data: 0 (Default Enabled) / 1 (Disabled)The setting starts taking effect at the next LDAP connection.

Server 2025 will support randomly generated passwords

It’s recommended that you test to ensure that no impact is made to your domain. You may wish to use tools such as IISCrypto in order to back up the current working settings before you make adjustments. If there are systems still sending requests over lower-level security settings, you need to ensure they can support the level of ciphers you have enabled. You will need port 636 open on your domain controller for LDAPS to work.Next, Server 2025 will support randomly generated passwords for machine accounts, making brute-force attacks more difficult. Machine accounts are identified by the presence of a $ character at the end of the account name. As with all things in Active Directory, even devices and machines need to have an account to join the domain.Most machine accounts have strong passwords generated automatically and randomly every 30 days. Ensure you review your network and domain for any device that demands a “pre-windows 2000” computer account assignment.The passwords for these devices are weak and often can be cracked if based on the lowercase name of the machine itself, which was often the case in previous eras. If an attacker steals a machine account, there are often various techniques that can be used to perform reconnaissance on the network ranging from browsing authenticated shares, establishing persistence or initiating attacks on the domain. Always review event 4741 in your event logs to determine if a new unknown machine has joined your domain.Server 2025 also mandates encrypted connections required for operations involving confidential attributes. This ensures that unauthorized interception and access to data will not occur during transmission.

Make sure to employ Server 2025 patches

That’s not to say that Windows Server 2025 has been bug-free since release it has already been patched for six spoofing bugs, 12 security feature vulnerabilities, 71 remote code execution bugs (some critical), 24 information disclosure bugs, 77 elevation of privilege bugs, and 27 denial-of-service bugs since November.