channel binding

Channel binding is a security mechanism that ties authentication to a specific communication channel, preventing relay attacks. On Windows, it is commonly applied to LDAP over SSL/TLS and NTLM authentication. Microsoft has introduced protections that enforce channel binding for LDAP, as described in CVE-2017-8563, and has announced plans to enable LDAP channel binding by default in Active Directory environments. These measures help mitigate NTLM relay attacks by ensuring authentication tokens are bound to the encrypted session, making them unusable if intercepted and replayed. Administrators can configure channel binding via the LdapEnforceChannelBinding registry entry to enhance security.