Researchers from Huntress showed that using `.LDAP Ping` (also called `.cLDAP`) to enumerate Active Directory usernames leaves no trace in Windows audit logs. Requests are handled by `.netlogon.dll` instead of `.ntdsa.dll`, so `.Event 1644` is never triggered, making detections relying on traditional LDAP logging ineffective. However, the traffic is still visible on the network level (`UDP/389`, WFP traces).

This pre‑authentication technique allows attackers with anonymous access to obtain a list of valid AD usernames, forming a base for further authenticated reconnaissance via tools like `.BloodHound` or `.PowerView`. The attack requires no credentials and yields confirmed account names for subsequent brute‑force or privilege mapping stages.

Article: https://www.huntress.com/blog/ldap-active-directory-detection-part-six

Research shows .LDAP Ping enumerates Active Directory usernames without leaving audit logs traces in Windows, but traffic is visible at network level.

LDAP Ping as a blind spot in AD discovery