A new Windows Server 2025 AD deployment rejects a legacy client's unencrypted simple bind. Which compatible client change addresses credential transport protection?

Choose the single best answer.

A.Use a correctly validated TLS LDAP session or a suitable secure SASL method
B.Make the bind account a Schema Admin
C.Open TCP 389 again and keep the bind unchanged
D.Disable all directory security policies permanently

Show the answer and explanation

✓ Correct answer

Use a correctly validated TLS LDAP session or a suitable secure SASL method

TLS protects simple-bind credentials, while an appropriate secure SASL method supplies its required protections. Opening an already reachable port cannot satisfy security requirements; schema privilege and blanket security removal do not provide protected authentication.

Read the source reference

Read and review here, or open the app to practise and save your results on this device.

Practise in the app

Unofficial study material, independently written and not affiliated with or endorsed by Microsoft. These are original learning questions, not actual exam questions. Product support and exam scope can change; a practice percentage is not a Microsoft exam scaled score.