Active Directory Authentication Ports
To set up active directory authentication ports, open TCP and UDP the configured port for Kerberos and the configured port for LDAP. You also need TCP the configured port for secure LDAP and the configured port for DNS lookups. Teams often open wide firewall ranges to get domain logins working fast. Broad network rules let any host talk to domain controllers and raise security risks. How active directory authentication ports work Every domain login starts with a DNS check on the configured po
Active Directory + Multi-Factor Authentication (MFA): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
To set up active directory authentication ports, open TCP and UDP the configured port for Kerberos and the configured port for LDAP. You also need TCP the configured port for secure LDAP and the configured port for DNS lookups. Teams often open wide firewall ranges to get domain logins working fast. Broad network rules let any host talk to domain controllers and raise security risks.
How active directory authentication ports work
Every domain login starts with a DNS check on the configured port. A client machine asks DNS to find the nearest domain controller. Once the client finds the server, it sends a login request over the configured port. This Kerberos step checks who the user is and gives back a session ticket.
Apps and servers also use LDAP on the configured port to read user groups and roles. Because standard LDAP sends data in plain text, teams should use the configured port for encrypted traffic. If your setup spans multiple forests, you also need Global Catalog ports. The configured port handles standard Global Catalog reads, while the configured port encrypts that traffic with TLS.
Server-to-server tasks and older tools often need TCP the configured port for SMB file shares. They also use TCP the configured port for remote procedure calls. During these calls, servers pick high dynamic ports between 49152 and 65535. You must scope firewall rules so only trusted subnets can reach these ports.
How to lock down directory network rules
Start by mapping every app and server that needs to check user logins. Place domain controllers in a dedicated network zone behind an internal firewall. Allow client subnets to reach only the exact ports needed for Kerberos, DNS, and secure LDAP.
Block plain text LDAP on the configured port from untrusted zones whenever you can. Force apps to bind over the configured port so passwords and group reads stay encrypted on the wire. Restrict high dynamic ports and the configured port to domain controllers and admin hosts only.
Review firewall logs each week to spot blocked login tries or strange port scans. Tight network rules keep rogue devices from probing your directory servers.
Active Directory + Multi-Factor Authentication (MFA): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
What port rules solve and what they miss
Good firewall rules make sure only approved hosts can reach your domain controllers. They stop attackers on guest networks from sending login requests or reading directory trees. Opening the right ports keeps user logins fast and reliable across your sites.
Still, network ports and directory logins only check who can log in at the start. Once a user or app passes the check, the directory steps out of the way. Port rules cannot see what commands an engineer runs inside a server session. They also cannot see which database rows a script reads after login.
If an admin role is too broad, one valid login grants full control over production data. Directory groups cannot pause a risky delete command or rewrite sensitive fields like emails, phone numbers, card numbers, or national IDs in query results. Teams need controls that inspect each command and query in flight, not just the initial network check.
Check database and API queries on the wire
Identity tools, roles, and network rules decide who opens a session. Setup alone cannot check what each query does or mask sensitive values in a response once a session starts. When workflows touch Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes APIs, SSH, or internal HTTP APIs, hoop.dev runs beside those services as an open-source proxy, a sidecar for your Postgres or API. It inspects requests coming in and results going back on the wire.
Your login details and client tools stay as they are while hoop.dev guardrails refuse bad deletes or drops before they run. On responses, hoop.dev data masking rewrites matched sensitive values in memory. Furthermore, hoop.dev holds SOC 2 Type II, is MIT licensed, and writes every query and decision to an audit trail that generates evidence for HIPAA, GDPR, and PCI DSS. See the source on GitHub.
Frequently asked questions
Which port is most important for domain logins?
The configured port is the main port for Kerberos logins on both TCP and UDP. Without the configured port and DNS on the configured port, domain logins will fail right away.
Should I use the configured port or the configured port for app logins?
Use TCP the configured port whenever your app supports LDAPS. The configured port encrypts traffic with TLS, while the configured port can expose plain text data unless you require signing.
Why do domain controllers use ports 3268 and 3269?
Ports 3268 and 3269 serve the Global Catalog across a multi-domain forest. Apps use them to search for users and groups across all domains at once.