Windows Communication Ports

Overview of Windows Communication Ports

Understanding Windows communication ports is essential for system administrators and IT professionals. This guide provides an overview of the most commonly used ports in Windows environments, their purposes, and best practices for managing them.

This guide contains port requirements for various Active Directory® and Active Directory Domain Services (AD DS) components. Both writable domain controllers and read-only domain controllers (RODCs) have the same port requirements.

For a complete list of ports used by Active Directory Domain Services, refer to the official Microsoft documentation.

Above is the list of common ports used by Active Directory and Active Directory Domain Services. Properly configuring and managing these ports is crucial for maintaining a secure and efficient Windows environment.

Domain Controllers replication ports

Domain controllers use several ports for replication purposes. Ensuring these ports are open and properly configured is vital for the health of your Active Directory environment.

Below is a diagram illustrating the key ports used for domain controller replication:

The primary ports used for domain controller replication include:

• TCP/UDP 53: Used for naming resolution (DNS).
• TCP/UDP 88: Used for Kerberos authentication.
• TCP/UDP 135: Used for RPC endpoint mapping.
• TCP 389: LDAP port for directory services.
• TCP 636: Secure LDAP (LDAPS) port.
• TCP 445: SMB port for file sharing and replication.
• TCP 3268: LDAP Global Catalog port.
• TCP 3269: Secure LDAP Global Catalog port.
• Ephemeral Ports (49152-65535): Used for various replication tasks.

Active Directory Authentication Ports

Active Directory authentication relies on several key ports to facilitate secure communication between clients and domain controllers. Proper configuration of these ports is essential for ensuring reliable authentication services.

The main ports used for Active Directory authentication include:

• TCP/UDP 53: Used for naming resolution (DNS).
• TCP/UDP 88: Kerberos authentication.
• TCP/UDP 389: LDAP for directory services.
• TCP 445: SMB port for file sharing and replication.
• TCP/UDP 464: Kerberos password change.
• TCP 636: Secure LDAP (LDAPS).
• Ephemeral Ports (49152-65535): Used for various authentication tasks.

Active Directory Distributed File System (DFS) Ports

Active Directory DFS relies on several key ports to facilitate file replication and access across the network. Proper configuration of these ports is essential for ensuring reliable DFS services.

The main ports used for Active Directory DFS include:

• TCP 135: Used for RPC endpoint mapping.
• TCP 138: Datagram service mapping (DFSN).
• TCP 139: ADWS (Active Directory Web Services).
• TCP/UDP 389: LDAP for directory services.
• TCP 445: SMB port for file sharing and replication.
• TCP 636: Secure LDAP (LDAPS).
• Ephemeral Ports (49152-65535): Used for various DFS tasks.

Active Directory Event Logs Ports

Active Directory event logs rely on several key ports to facilitate logging and monitoring across the network. Proper configuration of these ports is essential for ensuring reliable event logging services.

The main ports used for Active Directory Event Logs include:

• TCP 137: Used for NETLOGON.
• TCP 138: Datagram service mapping (DFSN).
• TCP 139: ADWS (Active Directory Web Services).
• TCP 445: SMB port for file sharing and replication.

Active Directory Group Policy Ports

Active Directory Group Policy relies on several key ports to facilitate policy application and management across the network. Proper configuration of these ports is essential for ensuring reliable Group Policy services.

The main ports used for Active Directory Group Policy include:

• TCP 135: Used for RPC endpoint mapping.
• TCP/UDP 389: LDAP for directory services.
• TCP 445: SMB port for file sharing and replication.
• TCP 636: Secure LDAP (LDAPS).
• Ephemeral Ports (49152-65535): Used for various Group Policy tasks.

Active Directory Kerberos Key Distribution Center (KDC) Ports

Active Directory Kerberos KDC relies on several key ports to facilitate secure authentication across the network. Proper configuration of these ports is essential for ensuring reliable Kerberos services.

The main ports used for Active Directory Kerberos KDC include:

• TCP 88: Kerberos authentication.
• TCP/UDP 389: LDAP for directory services.
• TCP 464: Kerberos password change.
• TCP 636: Secure LDAP (LDAPS).

Active Directory NetLogon Ports

Active Directory NetLogon relies on several key ports to facilitate secure authentication and logon services across the network. Proper configuration of these ports is essential for ensuring reliable NetLogon services.

The main ports used for Active Directory NetLogon include:

• TCP/UDP 135: Used for RPC endpoint mapping.
• TCP/UDP 389: LDAP for directory services.
• TCP 445: SMB port for file sharing and replication.
• TCP 636: Secure LDAP (LDAPS).
• Ephemeral Ports (49152-65535): Used for various NetLogon tasks.

Active Directory Remote Procedure Call (RPC) Ports

Active Directory RPC relies on several key ports to facilitate remote communication and management services across the network. Proper configuration of these ports is essential for ensuring reliable RPC services.

The main ports used for Active Directory RPC include:

• TCP/UDP 135: Used for RPC endpoint mapping.
• TCP 137: Used for NETLOGON.
• TCP 138: Datagram service mapping (DFSN).
• TCP 139: ADWS (Active Directory Web Services).
• TCP 445: SMB port for file sharing and replication.

Active Directory Certificate Ports

Active Directory Certificate relies on several key ports to facilitate secure certificate usage across the network. Proper configuration of these ports is essential for ensuring reliable certificate usage.

The main ports used for Active Directory Certificate include:

• TCP/UDP 135: Used for RPC endpoint mapping.
• TCP 139: ADWS (Active Directory Web Services).
• TCP 445: SMB port for file sharing and replication.
• Ephemeral Ports (49152-65535): Used for various tasks.

Comprehensive Port List for Domain Controllers and RODCs

For a detailed and comprehensive list of ports used by Domain Controllers and Read-Only Domain Controllers (RODCs), please refer to the official Microsoft documentation or trusted IT resources. Properly managing these ports is crucial for maintaining a secure and efficient Active Directory environment.

The following table provides a comprehensive overview of port requirements for Domain Controllers and Read-Only Domain Controllers (RODC), showing which protocols (TCP/UDP) are used by each service.

Ephemeral Ports (Dynamic Ports)

Ephemeral ports, also known as dynamic ports, are temporary ports assigned by the operating system to client applications when they initiate a connection. These ports are typically used for the duration of a single session and are released back to the pool of available ports when the session ends.

The following table shows the Client-Server Port Communication ephemeral port ranges used by clients when communicating with specific server ports and services:

Management and other ports

In addition to the core Active Directory ports, there are several management and auxiliary ports that are important for maintaining and administering Active Directory environments. These ports facilitate various management tasks, remote administration, and additional services that support Active Directory operations.

References

The following official resources provide detailed guidance on Windows port requirements, RPC dynamic ports, and Active Directory firewall considerations.

• Service overview and network port requirements for Windows
• How to configure a firewall for Active Directory domains and trusts
• Active Directory and Active Directory Domain Services Port Requirements (previous versions)
• How to configure RPC dynamic port allocation to work with firewalls
• Restrict Active Directory RPC traffic to a specific port
• The default dynamic port range for TCP/IP has changed (KB 929851)
• Remote Procedure Call (RPC) errors troubleshooting guidance
• Installation and Configuration for Windows Remote Management (WinRM)
• IANA Service Name and Port Number Registry