We patched our Active Directory DC's over the weekend with KB401550 and within 30 minutes we started to get failed LDAPS lookups. I have checked in the Identity Sources on the Operations Console and I get hit and miss when verifying the connection. Sometimes it works, and then sometimes it doesn't. Has anyone else experienced this problem occurring?
If you are sure of this version, then your AM does not have support for the latest TLSv1.2 protocol, which might be the reason this is failing. Verify in Ops Console
and I would update to AM 8.1 SP1 - first patch, and then to P15 patch 15 for AM 8.1 SP1. This will support TLSv1.2 and earlier protocol versions. AM 8.2 supports TLSv1.2 and eliminates the RC4 Ciphers a lot of Vulnerability Scans complain about with AM. This is important because the LDAPS connection will negotiate SSL protocol and Ciphers between Authentication Manager and your AD Domain Controller
You sure of the KB number ? cannot find a 6 digit Microsoft KB in any of my searches.
Sorry, I got the KB wrong with a typo. It is KB4015550.
"This security update includes improvements and fixes that were a part of update KB4012220 (released March 21, 2017) and also resolves security vulnerabilities in Internet Explorer, Scripting Engine, Hyper-V, Win32K, Adobe Type Manager Font Driver, Microsoft Outlook, Graphics component, Lightweight Directory Access Protocol and Windows OLE."
The problem occurred right around the time this patch was installed and we started rebooting the DC's to apply the changes. I'm getting around a dozen "Failed to connect to LDAP Identity Source" emails an hour but it seems to work upon a retry. This is most likely because only half of the DC's were patched. We will most likely hold off the patching for the remaining DC's that would go out this weekend.
The correct version of the AM software is also 8.2 P 01. This means that the TLS ciphers may not be the problem.
I should have said... We are on 8.1 p3 and soon to go to 8.1 sp1.