This article addresses questions related to environments where LDAPS is enabled.
1) What LDAP protocol is currently used by Enterprise Reporter?
Enterprise Reporter supports LDAP (default) and LDAPS for Active Directory (AD) discovery/collection (directory queries).
Standard ports:
LDAP: TCP/UDP 389
LDAPS: TCP 636
LDAP/LDAPS is used for reading directory data as part of AD discovery/collection.
2) Can ER be configured to use secure LDAP (LDAPS) on port 636, and will it operate smoothly?
Yes. ER supports LDAPS over TCP 636 for secure AD directory queries.
Smooth operation depends on correct environmental setup (certificates, trust chain, firewall rules, TLS compatibility).
3) Are there limitations or compatibility issues that require staying on standard LDAP?
There is no general requirement to remain on standard LDAP if LDAPS is properly configured and available.
Note: Enabling LDAPS secures the directory query traffic; other discovery/collection activities may still require additional ports/protocols as documented (e.g., DNS, Kerberos, RPC/SMB, SQL), depending on the configured discovery scope.
4) Pre-checks before switching to LDAPS (TCP 636)
Domain Controller readiness
Confirm each target Domain Controller supports LDAPS and has a valid SSL/TLS certificate with Server Authentication.
Certificate trust on ER servers/nodes
Ensure ER hosts trust the issuing CA chain (root/intermediate CAs).
Firewall / network validation
Confirm TCP 636 is open from ER components to the Domain Controllers.
Test LDAPS connectivity
From ER servers/nodes, validate LDAPS connectivity using a tool such as ldp.exe (confirm successful SSL/TLS connection and bind).
Confirm all required ports for the discovery scope
Validate other required ports remain open per Quest documentation.
5) Post-change verification (after enabling LDAPS/636)
After switching to LDAPS, validate the following:
Connectivity
ER can consistently establish LDAPS sessions to the Domain Controllers over TCP 636.
Discovery/collection success
Run the AD discovery/collection and confirm it completes successfully (no certificate/TLS/connection failures).
Directory data validation
Confirm expected AD objects/attributes are returned (e.g., users, groups, computers, OUs—based on scope).
Certificate validation
Confirm no certificate trust issues (expired certs, untrusted CA, name mismatch, incorrect EKU).
Logging review
Review ER logs/results for TLS handshake issues, bind failures, or timeouts.
Reference: Quest ER 3.6 Port Requirements [1]
https://support.quest.com/technical-documents/enterprise-reporter/3.6/port-requirements
6) Once LDAPS is enabled in the environment and apply GPO to force it, does that GPO need to apply to ER, Nodes and DB as well or just ER and Nodes?
LDAPS is available on each Active Directory discovery scope page. The checkbox on each AD discovery scope page must be selected for the discovery to use LDAPS.
The policy needs to cover systems that function as LDAP clients to AD—typically the ER server and any ER nodes running discoveries. The database generally does not require the LDAPS client-side policy.
7) Once GPO is applied do the services on ER and nodes need to be restarted?
After the GPO is applied, we recommend restarting the Enterprise Reporter services on the ER server and all nodes. This ensures any existing LDAP sessions are torn down and new connections are established using the enforced LDAPS requirements.
8) If discoveries are running at the time they force GPO to enable LDAPs, what is the impact? will discovery automatically change to use LDAPs, or will it fail or will it finish with the default LDAP connection?
If the GPO is enforced while discoveries are running, potential failures or partial results should be expected. Existing connections may succeed, but new connections may fail because each discovery makes multiple connections to AD that will still be using LDAP. Each discovery configuration will need to be updated by selecting the 'Use LDAPS' checkbox to use LDAPS. Best practice is to stop all running discoveries, enable LDAPS on each AD discovery, apply the GPO, restart ER/Node services, and then rerun AD discoveries.
