Why is my Exchange server talking to DCs using DC protocols?

Question

I'm in the process of tidying up my firewall rulebase and have noticed one of my exchange servers is talking to a DC using ports I'd expect to see for inter-DC replication.

For example, Port 135, nbdatagram, nbname, 49155, domain-udp, and various others.

All the traffic is going to one particular DC (i.e. isn't spread around all the DCs in the estate) and I'm stumped as to why.

Any suggestions as to what is going on?

(The Exchange server isn't a DC, by the way.)

Answer 1

According to Micosoft's documentation about firewalls and Exchange, it's not unknown for Exchange to talk to domain controllers across a variety of ports. Exchange 2000/2003 behaves differently than Exchange 2007/2010, so this may vary based on what you're actually running.

For 2007/2010, they have a nice article breaking down what ports each server role uses.

http://technet.microsoft.com/en-us/library/bb331973.aspx

Client Access Server:

• TCP
  • 53
  • 80
  • 88
  • 110
  • 135
  • 143
  • 389
  • 443
  • 993
  • 995
  • 3268
  • 5060-2
  • 5075-77
• UDP
  • 53
  • 88
  • 389

Answer 2

You don't mention which version of Exchange you're running (2003, 2007, 2010) but Exchange server relies entirely on AD as almost all of the Exchange configuration is stored in AD, and as such communicates almost non stop (although it does cache much of the information) with your DNS servers, your DC's and your GC's. Depending on the version of Exchange you're running you're going to see communication on the following ports from your Exchange server to your DNS, DC, and GC (note that these are the destination ports):

389/TCP/UDP (LDAP)

3268/TCP (LDAP GC)

88/TCP/UDP (Kerberos)

53/TCP/UDP (DNS)

135/TCP (RPC netlogon)