What is a directory service?
A directory service is a specialised database optimised for reading and searching rather than frequent writes. It stores objects — users, computers, printers, groups — and their attributes, organised in a hierarchical tree structure.
Think of it as a company's phone book, but far more powerful. Instead of just names and numbers, it stores every attribute about every user and device: password hashes, group memberships, login times, email addresses, department, manager, certificate information, and more. LDAP is the protocol that lets applications query and update this directory.
LDAP vs LDAPS — the port distinction
This is the most reliably tested LDAP fact on Network+ and Security+. Know both ports and what the difference means:
| Protocol | Port | Encryption | Use |
|---|---|---|---|
| LDAP | TCP/UDP 389 | ✗ Plaintext — credentials visible in traffic | Legacy environments only — should not be used for authentication over untrusted networks |
| LDAPS | TCP 636 | ✓ TLS encrypted — credentials protected | Production standard — LDAP wrapped in TLS, same as HTTP vs HTTPS |
| LDAP + StartTLS | TCP 389 | ✓ Upgrades to TLS mid-session | Alternative to LDAPS — starts unencrypted on 389 then upgrades. Less preferred than LDAPS. |
389 = LDAP (plaintext). 636 = LDAPS (encrypted with TLS).
Same relationship as HTTP (80) and HTTPS (443), or FTP (21) and FTPS (990). The exam will present a scenario where credentials are being transmitted insecurely over LDAP and ask how to fix it — the answer is always switch to LDAPS on port 636.
LDAP directory structure
LDAP directories are organised as a hierarchical tree called the Directory Information Tree (DIT). Every entry in the tree is called a Distinguished Name (DN) — a unique path that identifies exactly where an object sits in the hierarchy.
Domain: company.com Tree root (DC = Domain Component): DC=company,DC=com ← root of the domain │ ├── OU=Users,DC=company,DC=com ← Organisational Unit │ ├── CN=John Smith,OU=Users,DC=company,DC=com │ └── CN=Jane Doe,OU=Users,DC=company,DC=com │ ├── OU=Computers,DC=company,DC=com │ └── CN=DESKTOP-01,OU=Computers,DC=company,DC=com │ └── OU=Groups,DC=company,DC=com └── CN=IT-Admins,OU=Groups,DC=company,DC=com
DN (Distinguished Name) — the full unique path to an object. Example: CN=John Smith,OU=Users,DC=company,DC=com
CN (Common Name) — the name of the object itself (a user, group, or computer).
OU (Organisational Unit) — a container for grouping objects. Like a folder. You apply Group Policy at the OU level in Active Directory.
DC (Domain Component) — one label of the domain name. company.com becomes DC=company,DC=com.
How LDAP authentication works
When an application needs to verify a user's credentials against a directory, it uses an LDAP bind operation — connecting to the directory server and authenticating. There are two types of bind:
User enters credentials into an application 1. App connects to LDAP server on port 636 (LDAPS) 2. App binds using a service account DN + password (a read-only account dedicated to LDAP lookups) 3. App searches for the user: Filter: (&(objectClass=user)(sAMAccountName=jsmith)) 4. LDAP returns the user's full DN 5. App attempts to bind again using the user's DN + entered password 6. If bind succeeds → authentication successful If bind fails → wrong password — deny access
LDAP and Active Directory
Active Directory is not the same as LDAP — AD is a directory service that uses LDAP as one of its access protocols. Active Directory also uses Kerberos for authentication, DNS for service location, and Group Policy for configuration management. LDAP is the query language AD speaks.
In a Windows domain environment, applications that need to look up users or verify group memberships do so via LDAP queries to a Domain Controller. The Domain Controller listens on ports 389 (LDAP) and 636 (LDAPS) for these queries.
"Which protocol does Active Directory use to allow applications to query user and group information?" → LDAP
"An application needs to authenticate users against Active Directory. Which port should be used to ensure credentials are encrypted?" → 636 (LDAPS) — plain LDAP on 389 sends credentials unencrypted.
Remember: AD uses both LDAP (for directory queries) and Kerberos (for authentication tickets). They serve different purposes and are both tested.
LDAP injection — the Security+ attack
LDAP injection is an attack that targets applications which build LDAP queries using unsanitised user input — the LDAP equivalent of SQL injection. If an application constructs an LDAP filter by directly concatenating user-supplied values, an attacker can manipulate the filter to bypass authentication or extract directory data.
Vulnerable application builds this LDAP filter:
(&(uid=[username input])(password=[password input]))
Attacker enters as username: admin)(&(password=*
This manipulates the filter to always return true, bypassing the password check entirely and logging in as admin with any password.
Prevention: Input validation and sanitisation — escape special LDAP characters in user input before building queries. Use parameterised LDAP queries where available.
LDAP security hardening
Use LDAPS (port 636) → Encrypt all LDAP traffic with TLS Never send credentials over plain LDAP (389) Disable anonymous bind → Require authentication for all directory queries Prevents unauthenticated enumeration of users/groups Use dedicated service accounts → Read-only accounts for LDAP lookups Limit blast radius if the account is compromised Restrict LDAP access by IP → Only allow LDAP queries from app servers Use firewall rules to block port 389/636 elsewhere Sanitise LDAP queries → Escape special characters to prevent LDAP injection Treat all user input as untrusted
Exam scenarios
Studying for Security+?
The SY0-701 study guide, Dion Training practice exams, and Professor Messer's free course.