Re: Help Understanding LDAP Variants

The GC ports are used A LOT by normal Windows operations - it is how Windows finds things in the directory. For instance START | SEARCH | PRINTERS, COMPUTERS, OR PEOPLE will hit the GC.

If you don't have certs on the DCs the ports are effectively dead. Apps will connect to the port and send a SSLV2 Hello and then get bounced by the DS service when it realizes it doesn't have a cert. Nothing else on the DC should be able to use those ports as LSASS will grab them right off.


Obviously if you really want to know if you can block a port, the best way is to do a long term trace on the machine for the ports in question and look at what is coming through. Untold numbers of issues have been caused by people just throwing up traffic filters and then having no clue how it will impact them and then when weird things occur don't make the connection with the changes they made. From that you can probably see that I am not a proponent of firewalling between DCs any anything.

--
Joe Richards Microsoft MVP Windows Server Directory Services
Author of O'Reilly Active Directory Third Edition
www.joeware.net


---O'Reilly Active Directory Third Edition now available---

http://www.joeware.net/win/ad3e.htm


Will wrote:
"Joe Richards [MVP]" <humorexpress@xxxxxxxxxxx> wrote in message
news:eA#02eBLHHA.1248@xxxxxxxxxxxxxxxxxxxxxxx
They can all be used at different times by different applications/users.
They have different purposes.

The GC port is regular LDAP, only it gives you a view of all objects in
the forest but a partial set of attributes for all of them. It is
generally used when you are looking for a specific object or set of
objects across an entire forest and you aren't sure what domain the
object is in. Say a specific user.

Is the GC port used by any Microsoft-distributed applications that an end
user (non administrator) would run? We are putting some firewall
restrictions on the domain controllers and I don't want to block anything
that might get used by an end user.


The SSL ports (aka LDAPS) versions of the ports cause the data
transferred to be encrypted. It requires some sort of certificate to
enable the encryption.

So by default it cannot be used without special setup on the server, and I
therefore assume if we block the encrypted ports 636 and 3269, no one is
going to notice them missing. I would prefer to not leave open ports that
do not connect to an actual service, since hackers love such situations as a
way to run their own programs on those ports and have it look like approved
network traffic.

.

Relevant Pages

  • RE: win2k3 active directory - firewall ports
    ... Windows Server 2003 and Windows 2000 Server ... For a mixed-mode domain that uses either Windows NT domain controllers or legacy clients, trust relationships between Windows Server 2003-based domain controllers and Windows 2000 Server-based domain controllers may necessitate that all the ports for Windows NT that are listed in the previous table be opened in addition to the following ports. ...
    (Focus-Microsoft)
  • Re: IPSec: Network sooo slooooow
    ... > to use ipsec filtering to secure domain controllers. ... > to the Windows 2003 Security Guide. ... > that are not in the same forest, all of the preceding ports for Windows NT ...
    (microsoft.public.windows.server.networking)
  • RE: win2k3 active directory - firewall ports
    ... win2k3 active directory - firewall ports ... The following are the required ports for AD the articles supporting are ... Windows Server 2003 and Windows 2000 Server ... For a mixed-mode domain that uses either Windows NT domain controllers ...
    (Focus-Microsoft)
  • Re: "Network" icon
    ... To close a number of ports, GRC suggests to use the Network icon and re-configure bindings to a certain indicted form. ... There seems to be no control of Server Types, no way to uncheck "i want to enable NetBIOS over TCP/IP" on any and all protocol lines, no way to install NetBEUI, and no way to change/set hardware adaptor bindings. ... 1- The information on the GRC page is severely out of date, it was written pre Windows 2000, it makes absolutely no mention at all of any operating systems post 1998. ...
    (microsoft.public.win2000.general)
  • Re: Strange ports open
    ... but both NetBIOS / Windows networking and Exchange open ... I recommend keeping a log of the ports found open ... Administration Tools [Server Manager, User Manager, Event Viewer, Registry ...
    (microsoft.public.security)
Loading