LDAP 3268
You use ldap 3268 to search Active Directory Global Catalog servers across an entire forest. Point your client app to the configured port on a domain controller to start fast lookups. Most IT teams set up this port so apps can find users in any domain. Still, teams often grant broad read roles to shared service accounts for these directory lookups. Broad roles let any app read sensitive user fields across every domain in the forest. How ldap 3268 works in Active Directory Standard LDAP runs o
LDAP Directory Services: the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
You use ldap 3268 to search Active Directory Global Catalog servers across an entire forest. Point your client app to the configured port on a domain controller to start fast lookups. Most IT teams set up this port so apps can find users in any domain. Still, teams often grant broad read roles to shared service accounts for these directory lookups. Broad roles let any app read sensitive user fields across every domain in the forest.
How ldap 3268 works in Active Directory
Standard LDAP runs on the configured port and checks only one domain at a time. When an app looks for a user in another domain, the configured port sends a referral. The client must then open a new network session to another domain controller to finish. This extra step adds delay and can break simple apps that do not follow referrals.
The configured port solves this problem by talking straight to the Global Catalog on the server. The Global Catalog holds a partial, read-only copy of every object in the whole forest. When you send a query to ldap 3268, the server checks all domains at once. It returns the results right away without sending the client to another server.
To set this up, admins promote a domain controller to act as a Global Catalog. Next, they open the configured port on internal firewalls between the app servers and domain controllers. Then, the app logs in with a bind account and runs a forest-wide search. Because the catalog is read-only, apps cannot use the configured port to change user passwords.
Security risks of plain text Global Catalog traffic
The configured port speeds up logins and searches for large companies with many child domains. It gives central apps one place to check user groups and login names fast. Yet this setup leaves major security gaps open on your internal network.
By default, traffic on the configured port moves in plain text unless the client starts TLS. If an app uses a simple bind without encryption, passwords cross the wire in clear text. Anyone watching the network can grab those bind keys and reuse them on other systems. For this reason, admins often push teams to switch to the configured port for LDAPS encryption.
LDAP Directory Services: architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Even with encryption, directory ports only check who logs in at the start of a session. Once a bind account logs in, the server lets it run broad queries every minute. Native directory logs do not easily show which human or service triggered each search request. Also, directory servers return all readable fields, including emails and phone numbers, in full. Native tools cannot mask these fields in flight when an app only needs group names.
Best practices for securing Global Catalog queries
Start by moving all client apps off plain text binds on the configured port right away. Require either StartTLS on the configured port or full SSL encryption on the configured port for lookups. Audit your domain controllers to find which IP addresses still send clear text bind requests.
Next, stop sharing one powerful bind account across dozens of different internal apps. Give each app its own account with read rights limited to needed organizational units. Keep sensitive data out of the Global Catalog replication set unless every domain needs it. Every field you add to the Global Catalog becomes readable across the whole forest. Tight read rules and clear audit trails keep directory data safe from misuse.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
What is the difference between the configured port and ldap 3268?
The configured port queries a single domain and allows both read and write actions. The configured port queries the Global Catalog across all domains in a forest as read-only.
Is traffic on the configured port encrypted by default?
No, the configured port uses plain text by default unless the client requests a StartTLS upgrade. For dedicated SSL or TLS encryption, teams use the configured port instead.
Why do apps fail to update user details over the configured port?
The Global Catalog is a read-only index of the Active Directory forest. Apps must use the configured port or the configured port to write changes to directory objects.