When connecting with Active Directory over LDAPS, clients can provide channel binding information to the server. Active Directory can enforce channel binding for LDAPS connections. However, if Active Directory always requires channel binding information from clients, WSTEP enrollments with Certificate Enrollment Gateway can fail. Active Directory provides the registry setting LdapEnforceChannelBinding that controls whether channel binding information is required from clients. For more information about this registry setting, see the Microsoft documentation.

To configure channel binding enforcement to Active Directory

1. Log into Active Directory as a member of the Domain Admins group.
2. Open the Windows registry:
   1. Select Start > Windows System > Run,
      The Run dialog box appears.
   2. Enter regedit.
   3. Click OK.

3. In the tree view, navigate to the following location: 

   HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services\NTDS\Parameters
4. Add the registry setting LdapEnforceChannelBinding if it does not exist:
   1. Select Edit > New > DWORD (32-bit) Value.
      
   2. Enter LdapEnforceChannelBinding.
5. Select LdapEnforceChannelBinding, and then select Edit > Modify.
   An DWORD (32-bit) Value dialog box appears.
   
6. In the Value data field, enter one of the following values:
   • 0 to disable channel binding validation, if supported. Clients that support channel binding tokens must provide channel binding information to the server.
   • (Recommended.) 1 to enable channel binding when supported.
   • 2 to always enable channel binding validation. All clients must provide channel binding information. Active Directory will reject requests from clients that do not provide channel binding information.
7. Click OK.