Active Directory Cookbook

14.3. Enabling Anonymous LDAP Access

Problem

You want to enable anonymous LDAP access for clients. In Windows 2000 Active Directory, anonymous queries were enabled by default, although restricted. With Windows Server 2003 Active Directory, anonymous queries are disabled except for querying the RootDSE.

Solution

Using a graphical user interface

1. Open ADSI Edit.

2. In the Configuration partition, browse to cn=Services → cn=Windows NT → cn=Directory Service.

3. In the left pane, right-click on the Directory Service object and select Properties.

4. Double-click on the dSHeuristics attribute.

5. If the attribute is empty, set it with the value: 0000002.

6. If the attribute has an existing value, make sure the seventh digit is set to 2.

7. Click OK twice.

Using VBScript

' This code enables or disables anonymous query mode for a forest. ' ------ SCRIPT CONFIGURATION ------ boolEnableAnonQuery = 2 ' e.g. 2 to enable, 0 to disable ' ------ END CONFIGURATION --------- set objRootDSE = GetObject("LDAP://RootDSE") set objDS = GetObject( _ "LDAP://cn=Directory Service,cn=Windows NT,cn=Services," _ & objRootDSE.Get("configurationNamingContext") ) strDSH = objDS.Get("dSHeuristics") for i = len(strDSH) to 6 strDSH = strDSH & "0" next strNewDSH = Left(strDSH,6) & boolEnableAnonQuery strNewDSH = strNewDSH & Right(strDSH, len(strDSH) - 7 ) WScript.Echo "Old value: " & strDSH WScript.Echo "New value: " & strNewDSH if strDSH <> strNewDSH then objDS.Put "dSHeuristics", strNewDSH objDS.SetInfo WScript.Echo "Successfully set anon ...