Find clients making unsigned LDAP binds (events 2887 and 2889)

#Requires -RunAsAdministrator
# Unsigned LDAP bind events on this domain controller. Read-only.
param(
    [int]$Hours = 24
)

$diagnosticsKey = 'HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Diagnostics'
$setting = Get-ItemProperty -Path $diagnosticsKey -Name '16 LDAP Interface Events' -ErrorAction SilentlyContinue
$level = if ($setting) { $setting.'16 LDAP Interface Events' } else { 'not set' }
Write-Output "16 LDAP Interface Events = $level (event 2889 needs 2 or higher)"

$filter = @{
    LogName   = 'Directory Service'
    Id        = 2887, 2889
    StartTime = (Get-Date).AddHours(-$Hours)
}

$events = @(Get-WinEvent -FilterHashtable $filter -ErrorAction SilentlyContinue)
if ($events.Count -eq 0) {
    Write-Output "No event 2887 or 2889 in the last $Hours hours."
}
$events | Sort-Object TimeCreated | Select-Object TimeCreated, Id, Message

Checked automatically against Microsoft's published cmdlet reference. KBY hasn't run it in your tenant; run it in a test environment first.

Where to run it

Each domain controller, in an elevated Windows PowerShell 5.1 session.

Reading the output

• Event 2887 is a summary logged once every 24 hours with the number of such binds. Event 2889 names each client (IP address and identity) but is only logged when the "16 LDAP Interface Events" diagnostic setting is 2 (Basic) or higher; the script prints the current level first.
• The script does not change the diagnostic level. Raising it is a change to the domain controller; follow the linked Microsoft article if you decide to.

Sources

The Microsoft reference page for every cmdlet the script calls, plus the API and product pages behind each permission and caveat.