| Previous | Next |
| ERROR_DS_INIT_FAILURE | ERROR_DS_SOURCE_DOMAIN_IN_FOREST |
ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION
Authentication alone does not guarantee LDAP packet privacy
ERROR_DS_NO_PKT_PRIVACY_ON_CONNECTION means the client-server session does not provide the confidentiality level required for the requested directory operation. A successful bind can authenticate the caller while leaving subsequent LDAP messages only signed for integrity, or even unprotected, depending on the bind type and negotiated SASL security layer.
Record whether the connection uses LDAPS or StartTLS, which SASL mechanism was negotiated, and whether signing or sealing was requested. For sensitive operations, establish TLS or a SASL confidentiality layer before sending the request; reconnecting with the same options will reproduce the error. Do not confuse LDAP signing policy with encryption: signing protects integrity, while packet privacy requires confidentiality. If a proxy or load balancer terminates TLS, verify where the LDAP security boundary actually ends.
Connection protection to verify
- LDAP, LDAPS, or StartTLS transport.
- Bind method and SASL mechanism.
- Integrity versus confidentiality flags.
- TLS termination point and certificate validation result.
References
- MS-ADTS: LDAP SASL integrity and confidentiality layers
- Microsoft: LDAP signing requirements and bind behavior
- IETF RFC 4511: LDAP security considerations
Looking for a different code? Search another status or error code.