3

What ports should be allowed in the firewall so that my workstations can access the Active Directory Server and have group policies pushed to the workstations.

The group policies are used to configure the workstations for hardening.

Workstations are running Windows 10

I did a search and found this list:

RPC endpoint mapper: port 135 TCP, UDP
NetBIOS name service: port 137 TCP, UDP
NetBIOS datagram service: port 138 UDP
NetBIOS session service: port 139 TCP
SMB over IP (Microsoft-DS): port 445 TCP, UDP
LDAP: port 389 TCP, UDP
LDAP over SSL: port 636 TCP
Global catalog LDAP: port 3268 TCP
Global catalog LDAP over SSL: port 3269 TCP
Kerberos: port 88 TCP, UDP
DNS: port 53 TCP, UDP
WINS resolution: port 1512 TCP, UDP
WINS replication: 42 TCP, UDP
RPC: Dynamically-assigned ports TCP, unless restricted

Do I need all of them? I am hoping to allow just enough ports instead of the whole list.

Improve this question
8
  • 2
    Assuming that you're referring to the Windows Firewall and that your domain clients are on the same network as the Domain Controller then a Domain Controller already has the appropriate firewall rules enabled in the Windows Firewall for domain client communication.
    – joeqwerty
    Dec 5, 2017 at 2:51
  • WINS resolution?? What year is this?!
    – Jacob Evans
    Dec 5, 2017 at 3:38
  • technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx
    – Jacob Evans
    Dec 5, 2017 at 3:40
  • firewalls between DCs and workstations are not supported
    – Jim B
    Dec 5, 2017 at 3:57
  • 1
    @Appleoddity I'm not paying M$ to have a DC on a site with only 1 or 2 workstations. Sometimes the site is just too small to warrant the expenditure of providing a server at all, let alone licensing fees for a DC. FYI 2 sites my current employer has, only have 1 workstation per site. Those sites just have a DSL/4G modem and a small VPN router to provide services to the network of 1 workstation and a printer.
    – BeowulfNode42
    Jan 2, 2020 at 0:18

0

Reset to default

You must log in to answer this question.

Browse other questions tagged .