Requires the connection to Active Directory to be TLS encrypted.

If you are using non ADSI mode (you have specified a domain name in the configuration) then this will use LDAP over TLS (port 636 or port 3269) and will take precedence over startTLS which upgrades a connection to TLS in place.

For ADSI mode this changes ADSI from negotiating encryption for the *authentication* part only to using TLS encryption for the entire connection.

Note: in either operating mode enabling this option requires that your domain(s) have the Certificate Services installed, or other manual setup has been performed.