We are currently segmenting our network. We will move the servers in another subnet than the clients. Of course the clients still need access to the domain controller to authenticate against it.

I found various articles about the ports that need to be accessible between the domain controllers to allow replication but none about the ports that are important for the clients. I'm pretty sure the client won't directly access the LDAP database for example and I want to reduce the attack surface as much as possible.

So which ports are needed for a client to be able to work with a domain controller?

tcp/53 DNS  
tcp/88 Kerberos  
tcp/135 RPC  
tcp/445 sysvol share  
tcp/389 LDAP  
tcp/464 Kerberos password (Max/Unix clients)  
tcp/636 LDAP SSL  (if the domain controllers have/need/use certificates)   
tcp/1688 KMS (if KMS is used.  Not necessarily AD, but the SRV record is in AD and clients need to communicate with the KMS).  
tcp/3268 LDAP GC
tcp/3269 LDAP GC SSL (if the domain controllers have/need/use certificates)   
tcp/49152 through 65535 (Windows Vista/2008 and higher) aka “high ports”  

udp/53 DNS
udp/88 Kerberos
udp/123 time  
udp/135 RPC  
udp/389 LDAP  
udp/445 sysvol share  

You can minimize the high-port range by configuring a static RPC port for Active Directory.

Restricting Active Directory RPC traffic to a specific port

It's usually a good idea to force Kerberos to use only tcp/ip, particularly if you have a large, complex network, or accounts are members of large number of groups/large token size.

How to force Kerberos to use TCP instead of UDP in Windows

  • Thank you for your excellent answer! This does spare me some time in front of wireshark.^^ – davidb Jun 26 '16 at 13:30

The client will need to access Kerberos so that's TCP 88 Then there is the Global Catalogue service so that's TCP 3268 There is the KPassword service TCP 464 (this allows password changes) Then there is LDAP port TCP 389, clients still need to access this to help locate domain controllers.

There are also UDP ports for Kerberos (88) and KPassword (464) I am not sure if these are needed or not. try without them first.

  • 1
    What about DNS ports TCP and UDP 53? DCs are often the DNS for domain joined machines. – Pep Jun 26 '16 at 11:30
  • Sorry I was just thinking of AD but yes if the DC is the DNS server as well then you would need UDP port 53. that's the port clients send queries on. TCP 53 is for DNS to DNS comms, Zone transfer etc. – Michael Brown Jun 26 '16 at 11:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.