Which Ports need to be accessible on a Domain Controller for Clients to logon?

networking active-directory firewall port domain-controller

11,867

Solution 1

tcp/53 DNS  
tcp/88 Kerberos  
tcp/135 RPC  
tcp/445 sysvol share  
tcp/389 LDAP  
tcp/464 Kerberos password (Max/Unix clients)  
tcp/636 LDAP SSL  (if the domain controllers have/need/use certificates)   
tcp/1688 KMS (if KMS is used.  Not necessarily AD, but the SRV record is in AD and clients need to communicate with the KMS).  
tcp/3268 LDAP GC
tcp/3269 LDAP GC SSL (if the domain controllers have/need/use certificates)   
tcp/49152 through 65535 (Windows Vista/2008 and higher) aka “high ports”  

udp/53 DNS
udp/88 Kerberos
udp/123 time  
udp/135 RPC  
udp/389 LDAP  
udp/445 sysvol share

You can minimize the high-port range by configuring a static RPC port for Active Directory.

Restricting Active Directory RPC traffic to a specific port
https://support.microsoft.com/en-us/kb/224196

It's usually a good idea to force Kerberos to use only tcp/ip, particularly if you have a large, complex network, or accounts are members of large number of groups/large token size.

How to force Kerberos to use TCP instead of UDP in Windows
https://support.microsoft.com/en-us/kb/244474

Solution 2

The client will need to access Kerberos so that's TCP 88 Then there is the Global Catalogue service so that's TCP 3268 There is the KPassword service TCP 464 (this allows password changes) Then there is LDAP port TCP 389, clients still need to access this to help locate domain controllers.

There are also UDP ports for Kerberos (88) and KPassword (464) I am not sure if these are needed or not. try without them first.

11,867

davidb

I'm an IT-specialist from germany who's generally doing Debian Linux/Win2012/Win2016 server administration and Ruby On Rails development for a research institute at the university of Bremen. Im also very interested in security related topics especial in network, wireless and web application security.

Updated on September 18, 2022

Comments

davidb almost 2 years

We are currently segmenting our network. We will move the servers in another subnet than the clients. Of course the clients still need access to the domain controller to authenticate against it.

I found various articles about the ports that need to be accessible between the domain controllers to allow replication but none about the ports that are important for the clients. I'm pretty sure the client won't directly access the LDAP database for example and I want to reduce the attack surface as much as possible.

So which ports are needed for a client to be able to work with a domain controller?
Pep about 8 years

What about DNS ports TCP and UDP 53? DCs are often the DNS for domain joined machines.
Michael Brown about 8 years

Sorry I was just thinking of AD but yes if the DC is the DNS server as well then you would need UDP port 53. that's the port clients send queries on. TCP 53 is for DNS to DNS comms, Zone transfer etc.
davidb about 8 years

Thank you for your excellent answer! This does spare me some time in front of wireshark.^^