Not a member of Pastebin yet?
Sign Up,
it unlocks many cool features!
- As of Server 2008:
- UDP-53 DNS-NS
- TCP-53* DNS-ZT
- UDP-88 KRB-TK
- TCP-88 KRB-TK
- UDP-123 NTP
- TCP-135 RPC-M
- UDP-389‡ LDAP
- TCP-389 LDAP
- TCP-445 SMB
- UDP-464‡ KRB-PW
- TDP-464‡ KRB-PW
- TCP-636‡ GC
- TCP-3268† LDAPS
- TCP-3269† GCS
- TCP-9389* SOAP Web Services
- TCP-49152-65535* RPC-E
- Optional:
- TCP-1688 KMS (if running KMS)
- TCP-80 HTTP (if running PKI)
- TCP-443† HTTPS (if running PKI)
- No longer needed:
- UDP-137 NetBIOS
- UDP-138 NetBIOS
- UDP-139 NetBIOS
- TCP-42 WINS
- TCP-1024-4096* RPC-E (old range - do NOT use 1024-65535 -- too dangerous!)
- All rules are uni-directional from domain member computer to domain controller. DC’s do not initiate traffic to clients for standard operations, ever!
- Rules between two domain controllers should be bidirectional on the above ports!
- Key:
- * Commonly forgotten or misunderstood
- † Used for SSL/TLS-based services (requires cert)
- ‡ Not well known or substantially documented
Advertisement
Add Comment
Please, Sign In to add comment
