LDAPS channel binding not enabled

A domain controller that does not require appropriate LDAP channel-binding tokens can accept a client's NTLM authentication relayed to it over LDAPS. Acceptance depends on the effective server policy, client CBT behavior, and whether the relay path omits or mismatches the token. A successful bind inherits only the relayed principal's directory permissions; this configuration alone does not grant privilege escalation.