TCP 445 is SMB, i.e. Windows file sharing.
You should monitor the SMB activity on your DCs; you can do that graphically from the Computer Management MMC or via PowerShell using the various Get-SmbXYX commands in SmbShare.
This could be a virus spreading through network shares; however, this is just a random guess and it could really be anything else.
These are very likely man sections:
1 Executable programs or shell commands
2 System calls (functions provided by the kernel)
3 Library calls (functions within program libraries)
4 Special files (usually found in /dev)
5 File formats and conventions eg /etc/passwd
7 Miscellaneous (including macro packages and ...
You can do this. I was doing this when setting up my LDAP server cluster. To get everything stood up, we used port 389. Once we had a certificate, we did the install and opened up port 636. We can use both without issue. As the project matures all the various services that are consuming LDAP are being moved over to port 636.
There is also a way to ...