Kerberos: Uses UDP port 88 by default User-ID (Ports used to talk to User-ID Agent) • TCP 5007 (The default Windows User-ID Agent service port number is 5007, though it is. Source IP address of the perimeter network interface and UDP source port of 1813 (0x715) of the NPS. 53 — TCP/UDP — DNS: map IP addresses to host names. UDP Port 389 for LDAP to handle normal queries from client computers to the domain controllers. See examples of network packets captured with WireShark and explanations of each port's function and firewall settings. (**) Für den Betrieb der Vertrauensstellung ist dieser Port nicht erforderlich, er wird nur zur Erstellung verwendet. Possible issues. It allows you to configure users and groups, access control, permissions, auto-mounting, and more. The Subject Alternative Name (SAN) extension in the DNS entry. Therefore the Active Directory server (Domain Controller) specified in Dashboard must also hold the Global Catalog role. Sep 25, 2017 · active-directory; port; Share. LDAP doesn't speak Telnet. 636. 445. RPC clients use the RPC Endpoint Mapper (EPM) which runs on TCP135 to tell them which dynamic ports were assigned to the server. This is the default UDP port that is used by NPS, as defined in RFC 2865. Remember to add all Domain Controllers that are responsible for the sites/subnets that the MX handles. com 389 and i get an empty screen with a blinking cursor. As an example, when a client computer tries to find a domain controller it always sends a DNS Query over Port 53 to find the name of the domain controller in the domain. Active Directory trusts cannot be created and maintained between your AWS Managed Microsoft AD directory and on-premises domain. See Okta account with required permissions . Below is a list of ports that need to be opened on Active Directory Certificate Services servers to enable HTTP and DCOM based enrollment Feb 21, 2023 · The default Send connector named "EdgeSync - <Active Directory site name> to Internet" relays outbound mail on port 25 from the Edge Transport server to the internet. 49152- 65535 (Random high RPC Port) (TCP) Used during the initial configuration of Microsoft Entra Connect when it binds to the AD forests, and during Password synchronization. If you are using a different port, substitute that port number for 1812. WinRM: 5985 (TCP) What firewall ports need to be open for Active Directory? Related. 3. The following materials are designed to help you with your deployment of this connector/source and answer planning questions. Global catalog server. Select Start > Administrative Tools > Active Directory Sites and Services. Select Active Directory in the get data experience. All you can accomplish with a Telnet client is to establish that the server can be connected to. If you implement these on your firewall then it will work. LDAP information Type: active-directory; If the server list has been populated and the servers are reachable by the management interface, the Base DN will auto populate when you click the drop-down arrow The Active Directory fully qualified domain name of the domain controller appears in one of the following locations: The common name (CN) in the Subject field. Nov 7, 2020 · Categories Active Directory, Administration, Configuration, DNS, Guides, Microsoft, Network Tags active directory ports, AD, firewall, network Leave a Reply Cancel reply Your email address will not be published. In the Port text box, type 3268. If you you want to reduce the number of ports that you needs open, then you will have to test what are the minimum ports required from this list for your specific Oct 3, 2022 · This port can't be configured but can be routed through a configured proxy server. Ansgar Wiechers. The default LDAP (unencrypted) port number is TCP 389. Oct 8, 2021 · Learn more about: Active Directory Replication Concepts. For instance, replication between servers that use Windows 2000 or 2003 require the following ports open bidirectionally on the firewall that's between the servers: RPC endpoint mapper: port 135 TCP; LDAP: port 389 Jun 14, 2022 · To block USB devices, you need to create a Group Policy Object and configure it with the desired settings. Il n’est utilisé que pour la création d’approbation. Active Directory Replication, Login services port 445. Sessions that use TLS/SSL by using a predetermined port (636, 3269, or a custom LDS port), or standard ports (389, 3268, or a custom LDS port) that use the STARTTLS extended operation. EdgeSync synchronization: 50636/TCP (secure LDAP) Mailbox servers in the subscribed Active Directory site that participate in EdgeSync synchronization: Edge Transport servers Active Directory serves as a foundational technology, enabling network administrators to efficiently create and manage domains, users, and objects within a network. I found this kb article which describes how to change it to a specific port on all of your domain controllers, which would then allow me to open up a Aug 16, 2022 · A directory service, such as Active Directory Domain Services (AD DS), provides the methods for storing directory data and making this data available to network users and administrators. The following ports are optional depending on services used, and tend to apply to Certificate Enrollment Web Services: TCP port 80: HTTP; TCP port 443: HTTPS; TCP port 445: SMB. Additional ports are required to use Active Directory with Connector Appliance. You can use this tool to see if you have access to the Active Directory recommended ports. These were outlined in the Active Directory Replication over Firewalls article by Steve Riley: RPC endpoint mapper: port 135 TCP, UDP; NetBIOS name service: port 137 TCP, UDP Apr 14, 2015 · I have a Linux domain running with sssd, let's call this domain NJ. ). Der Abschnitt „Domänencontroller und Active Directory“ in Dienstübersicht und Netzwerkportanforderungen für Windows. Mar 6, 2024 · I see traffic on port tcp/88 kerberos, getting all required tickets, I see some LDAP traffic udp/389, to validate the impersonation by ldap binding, but then I see rpc traffic, starting with a tcp port negotiation on tcp/135 (endpoint mapper), followed by communication on the ephemeral port region. Do not merely copy/paste this line! Change the parameter values to fit your intended domain name. Active Directory Domain Services is required for default Kerberos implementations within the domain or forest. Jan 24, 2020 · First published on TECHNET on Jun 25, 2010 . If this detection is successful, it will get the domain firewall profile (allowing for correct ports) and we cannot change the network location profile. Expand the Sites tree and Mar 26, 2021 · Introduction. You must also open your DCOM RPC ports. Jan 24, 2014 · If Windows Firewall, for instance, prevents your domain controllers from doing their job, it's because you didn't know what ports Active Directory needed before you turned the firewall on, or because you configured the policy incorrectly. ClearPass. Is there a reason for DCs to talk on port 42 and what will happened when I enable Windows Firewall on a servers. 10. Feb 10, 2021 · The below services and their ports used for Active Directory communication: UDP and TCP Port 135 for domain controllers-to-domain controller and client to domain controller operations. Warning Don't delete or modify any of the network resource created by Domain Services, such as manually configuring the load balancer or rules. Active Directory permits two means of establishing an SSL/TLS-protected connection to a DC. Jul 29, 2021 · The Kerberos Key Distribution Center (KDC) is integrated with other Windows Server security services that run on the domain controller. Feb 19, 2024 · An Active Directory domain controller listens for change-password requests on all of these protocols. May 1, 2014 · UDP Port 88 for Kerberos authentication. Improve this question. The KDC uses the domain's Active Directory Domain Services database as its security account database. These ports are required by both client computers and Domain Controllers. This host needs LDAP connectivity to your AD domain controller (ports 389/636 or whichever ports accept Active Directory binds), as well as HTTPS/443 connectivity to Duo. It Jul 24, 2014 · Sysinternals Active Directory (AD) Explorer. The purpose of this document is to detail how to configure Active Directory (AD) authentication for AnyConnect clients that connect to a Cisco Firepower Threat Defense (FTD) managed by Firepower Device Management (FDM). . You can define an alternate port in Configuration Manager for this value. You need two components to connect a RHEL system to Active Directory (AD). Don't use the Net time command to configure or set a computer's clock time when the Windows Time service is running. Active Directory is an essential part of Windows Server. LDAPS uses its own distinct network port to connect clients and servers. In the Value text box, type the IP address or DNS name of the Active Directory server. Kerberos port 88. AD Servers. RootDSE information should print in the right pane, indicating a successful connection. It requires you to ensure the “Client CIDR” network is secure. Also, on older computers that run Windows XP or earlier, the Net time /querysntp command displays the name of a Network Time Protocol (NTP) server with which a computer is configured to synchronize, but that NTP server is used only when the computer's time client is Jan 26, 2024 · For Active Directory Servers, click Add an Active Directory domain server. You can query access to the following services: Active Directory Domain Services (ADDS) After a bit of poking around for all the services and ports used by AD, I found that the RPC service uses random ports, which makes it difficult to punch a hole in the firewall to make it work. (Image: Daniel Petri) You can also use several built-in tools that are a part of the Windows OS. You can use these cmdlets to manage your Active Directory domains, Active Directory Lightweight Directory Services (AD LDS) configuration sets, and Active Directory Database Mounting Tool instances in a single, self-contained package. Can someone had this experience? and Can share the List of Firewall Ports required between DC and Exchange server communication? Jun 6, 2024 · Beschränken des Active Directory-RPC-Datenverkehrs auf einen bestimmten Port. I'd like machines on the NJ domain to be able to authenticate against an Active Directory ldap server which resides on a different domain (called NY) which is behind a firewall. The enhanced key usage extension includes the Server Authentication object identifier (1. The freeware application CurrPorts by NirSoft provides an easier way to view what is listening on a port, displaying detailed information about the process and allowing for better Sep 23, 2021 · This filter allows RADIUS authentication traffic from the NPS to Internet-based RADIUS clients. Type the name of the domain controller to which you want to connect. exe). In a multi-site environment (in order to optimize network traffic and reduce service delays) consider adding GC servers to ensure a quick response to search queries and Oct 9, 2021 · Understanding which ports are needed for active directory communication helps you to configure ports to allow them through the firewall. Jun 8, 2011 · Domain controllers, client computers and application servers require network connectivity to Active Directory over specific hard-coded ports in addition to a range of ephemeral TCP ports between 1024 and 65535 unless a tunneling protocol is used to encapsulate such traffic, An encapsulated solution might consist of a VPN gateway located behind RPC interfaces offered by Active Directory can use dynamic server ports (most are configurable. 1). Sep 24, 2023 · What is Azure Active Directory sync? Azure Active Directory sync often refers to two different Microsoft identity management tools, Azure AD connect sync and Azure AD Connect cloud sync. See Configure DMZ server ports for Active Directory integrations. One component, SSSD, interacts with the central identity and authentication source, and the other component, realmd, detects available domains and configures the underlying RHEL system services, in this case SSSD, to connect to the domain. For more information about the Power Query Desktop get data experience from your app, go to Where to get data. TCP and UDP Port 389 for LDAP to handle normal queries from client computers to the domain controllers. Sep 26, 2018 · Puertos utilizados para protocolos de Active Directory y comunicaciones de ID de usuario a Firewall Agente • ID de usuario sin agente utiliza WMI para extraer registros de seguridad que inicialmente utilizan el puerto 389, pero luego negociar. Using a static port lets the administrator constrain communication for an activity (such as Active Directory replication) to a known port. The first is by connecting to a DC on a protected LDAPS port (TCP ports 636 and 3269 in AD DS, and a configuration-specific port in AD LDS). On the Connection menu, click Connect. In addition to TCP 135, Microsoft RPC (MS-RPC) uses randomly generated ports from TCP 49152 through 65535 for Vista/2008 and later. Kerberos Passwords, port 464. See KB929851, KB832017, and KB224196 for more information. Active Directory communications involve a number of ports, some of which are more familiar to network and security administrators than others. TCP Port 139 and UDP 138 for File Replication Service between domain controllers. Destination ports that must be open The following table lists the destination ports that must be open to allow communication between SiteProtector System components and Active Directory: To use Active Directory SSO with computers joined to your domain with Azure Active Directory, you must install v12. Dear Team, In our organization users can change their ad passwords by clicking alt+cntl+delete when they are in LAN. Note 2: Alternate port available. Oct 27, 2009 · Microsoft provides OS-specific guidelines in its Active Directory and Active Directory Domain Services Port Requirements article. All required ports, protocols and services listed. Aug 14, 2020 · Yes, required. Start TLS extended request Feb 23, 2024 · Active Directory using several ports to communication between domain controllers to clients. Jan 26, 2022 · We have a request from Exchange application team to open ANY to Any communication between domain controllers and Exchange servers. local. The RPC end point mapper database listens to port 135. 5. ) Clients use the RPC Endpoint Mapper to find the server port of the RPC interface of a specific Active Directory service. LDAP over SSL. NET Developer’s Guide to Directory Services Programming, by Ryan Dunn and Joe Kaplan. This version of the agent supports hybrid environments, here a local Active Directory domain controller is used for authentication by the Firebox, and the computers are Feb 19, 2024 · Start the Active Directory Administration Tool (Ldp. It is engineered to scale, facilitating the organization of an extensive number of users into manageable groups and subgroups , while controlling access rights at various levels. For example, you can create an OU in Active Directory and add few test computers in that OU. May 31, 2023 · Caution. User-ID (ports utilisés pour parler à l'agent User-ID) • TCP 5007 (le numéro de port de service de l'agent d'ID utilisateur Windows par défaut est 5007, bien qu'il soit. 389. e. If using Active Directory Federation Services (ADFS) for single sign on the following ports are also required: TCP port 80: HTTP; TCP port 443: HTTPS; TCP port 49443 Jun 5, 2024 · Sessions on ports 389 or 3268 or on custom LDS ports that don't use TLS/SSL for a Simple Authentication and Security Layer (SASL) bind. However, these tools require that you have the AD-DS Active Directory port 3269(I f a Global Catalog is configured) Active Directory DNS port 53; Active Directory Replication, Login services port 445; Kerberos Passwords, port 464; Authentication port UDP 137; Authentication port TCP 137; The following diagram illustrates firewalls in place between IdentityIQ/Virtual Appliance components and LDAP Ports 389 and 636. Sep 25, 2018 · TCP port 389 is the standard port for unencrypted LDAP, port 636 is used when Require SSL/TLS secured connection is selected. Server timeout (seconds): The amount of time, in seconds, that the SonicWall will wait for a response from the LDAP server before timing out Sep 12, 2017 · This configuration has been reportedly tested on lab by Mr Yong Kam Wah, for full details see his blog post Firewall Ports Required to Join AD Domain. Authentication port TCP 139 Dec 5, 2017 · RPC endpoint mapper: port 135 TCP, UDP NetBIOS name service: port 137 TCP, UDP NetBIOS datagram service: port 138 UDP NetBIOS session service: port 139 TCP SMB over IP (Microsoft-DS): port 445 TCP, UDP LDAP: port 389 TCP, UDP LDAP over SSL: port 636 TCP Global catalog LDAP: port 3268 TCP Global catalog LDAP over SSL: port 3269 TCP Kerberos Mar 10, 2021 · Install the Active Directory Domain Services feature, including the management tools: Install-WindowsFeature -Name AD-Domain-Services -IncludeManagementTools Create the new Active Directory forest with the Install-ADDSForest command. In a domain that consists of Windows Server® 2003–based domain controllers, the default dynamic port range is 1025 through 5000. Jan 2, 2012 · Now then: from one of your Active Directory Domain Services domain controllers or from an administrative workstation, open the Group Policy Management Console and link a new GPO to the appropriate target (domain, OU, etc. Find Out if Your Active Directory Server is Configured as a Global Catalog Server. To add an Active Directory server, enter the following information: Sep 12, 2018 · AD-Related Ports. Use Registry Editor to modify the following values on each domain controller where the restricted ports are to be used. 160. The Active Directory module for Windows PowerShell is a PowerShell module that consolidates a group of cmdlets. An active directory port is a TCP or UDP port that services requests to an active directory domain controller. Move off to the right till you see Domain, look for the first period and the answer is that period Jun 4, 2021 · Active Directory communication involves the following ports and as a system administrator, you must be familiar with some of the following ports already. : 135 (TCP) It is used for the initial configuration of the Azure AD Connect wizard when it binds to the Active Directory forest, needed for sync of the Password. 53- DNS Jan 19, 2023 · Description of Ports. Save the Configuration File. Because the port is not opened in firewall. when users are connected to the vpn , they cant change the ad passwords. 198k 26 26 gold badges 274 274 silver badges 344 344 TCP & UDP port 88 for Kerberos Authentication; TCP & UDP 389 for LDAP; TCP & UDP 445 for SMB/CIFS/SMB2; TCP and UDP port 464 for Kerberos Password Change; TCP Port 3268 & 3269 for Global Catalog; TCP and UDP port 53 for DNS; TCP and UDP Dynamic - 1025 to 5000 ( Windows Server 2003 ) & start from 49152 to 65535 ( Windows Server 2008 ) for DCOM May 19, 2022 · The details that dspatrick has provides are the ports you need to open to support all communication between domains. If you are using a custom listening port on your LDAP server, specify it here. In the Active Directory dialog box, provide the domain for your Active Directory. To integrate Active Directory with the SiteProtector™ System, the Sensor Controller must be able to communicate with Active Directory over certain ports. 53 (TCP/UDP) 88 (TCP/UDP) 135 (TCP/UDP) 389 (TCP) 445 (TCP) 49152 – 65535 TCP/UDP Jan 9, 2024 · If this occurs on an Active Directory Domain Controller, an attacker can cause a server to make decisions that are based on forged requests from the LDAP client. In this article, we will discuss the Service and Network Port requirements for Active Directory. Nov 21, 2023 · Active Directory(AD) Ports and Protocols: Introduction: The purpose of this blog entry is to provide a simplistic and high-level overview of the various ports and protocols that operate with 5 days ago · If you don't plan to integrate Managed Microsoft AD with an on-premises Active Directory, you only need to read the first section of this article, Accessing Managed Microsoft AD from within your VPC. Sep 14, 2011 · Note: This series covers Active Directory connection strings, often referred to as bind paths, with the goal of simplifying the process of creating an AD bind path. Mar 19, 2024 · Access to: Microsoft Teams, SharePoint/OneDrive, Pro Management Portal, Microsoft Store, Windows Update, Intune, Entra ID, & Microsoft Common destinations. changeable) Ports Used for Active Directory Protocols and User-ID Communications to Firewall Agentless Nov 3, 2023 · Which ports are required on a Domain Controller or to access the Active Directory. Ports utilisés pour les protocoles Active Directory et les communications d'ID utilisateur au pare-feu . TCP 636 is only required when LDAP over SSL is in use. Ports for subnets. Create a user in Active Directory. On the host server, open a web browser and sign in to the Okta Admin Console using an account with suitable permissions. Active Directory Domain Services are required for default Kerberos implementations within the domain or forest. If the dynamic port has been changed, you need to open that port. Command line to list users in a Windows Active Directory group? 2. LDAP is a communication protocol that provides the ability to access and maintain distributed directory information services over a network. Active Directory port 3269. ilovebears. LDAP Lightweight Directory Access Protocol. variable. usando puertos aleatorios dinámicos para datos. The default port for LDAP is port 389, but LDAPS uses port 636 and establishes SSL/TLS upon connecting with a Active Directory attaches a Privilege Attribute Certificate (PAC) to the Kerberos ticket, which increases the size and requires to use the TCP protocol. For example, AD DS stores information about user accounts, such as names, passwords, phone numbers, and so on, and enables other authorized users on the same Sep 23, 2022 · How to: Go back to the nmap scan from earlier, look to port 389 that is running Active Directory. Oct 24, 2021 · The utility reports the port status of Transition Control Protocol (TCP) and User Datagram Protocol (UDP) ports on a remote computer. Feb 19, 2024 · If you configure Active Directory and Netlogon to run at port x as in the following entry, it becomes the ports that are registered with the endpoint mapper in addition to the standard dynamic port. Type 636 as the port number. A global catalog server is a domain controller that stores information about all objects in the forest, so that applications can search AD DS without referring to specific domain controllers that store the requested data. The KDC is integrated with Windows Server security services that run on the domain controller. It supports user/group management, group policies, multiple directory servers (i. TCP/UDP May 15, 2018 · In Active Directory, we use the Windows Time service for clock synchronization: W32Time; All member machines synchronizes with any domain controller; In a domain, all domain controllers synchronize from the PDC Emulator of that domain; In this article. Review network bandwidth and quality of service (QoS) requirements: QoS on Teams Devices Apr 1, 2021 · Microsoft Active Directory Domain Services (AD DS) are a directory service that organizes network resources within AD domains. They are only talking to each other on that port and they are all Windows 2008 R2. 1 or higher of the WatchGuard Single Sign-On (SSO) Agent. (**) Ce port n’est pas nécessaire pour le fonctionnement de l’approbation. Feb 19, 2024 · Limitation du trafic RPC Active Directory à un port spécifique. A significant amount of the information for this series comes from the wonderful AD programming book, The . Active Directory DNS port 53. The LDAP ADsPath article Oct 4, 2023 · The Active Directory Connector/Source is designed to aggregate and provision user and entitlement data from Microsoft Active Directory environments. In most enterprises, Microsoft's Active Directory (AD) is the default authentication system for Windows systems and for external, LDAP-connected services. , domain controllers), Kerberos authentication, etc. In our example below, we added all 5 Domain Controllers located in our Active Directory site. The get data experience in Power Query Desktop varies between apps. This lets firewalls be configured to allow traffic to only that port. Client machines use DNS to locate resource records in the domain and look up external domain Sep 10, 2023 · Learn the TCP and UDP ports used by Active Directory from client to server in different scenarios, such as logging in, running gpupdate, joining a domain, and rebooting. Jan 30, 2015 · telnet www. Please advise… Sep 22, 2023 · Connection to On-Premises Active Directory (Domain Controllers): The server running Azure AD Connect, needs full connectivity to your domain controllers. To avoid the fall-back and resending the request, by default, SSSD in Red Hat Enterprise Linux 7. 6. Pour plus d’informations sur la restriction de la réplication Active Directory et du trafic d’ouverture de session client, consultez l’article Comment limiter le trafic RPC Active Directory à un port spécifique. Microsoft has always had a bit of an issue positioning the various pieces that connect cloud services to on-premises servers. ClearPass to Active Directory ClearPass. Open required ports to the required destinations documented in Teams Rooms Network Security. 4 and later uses TCP for user authentication. Sep 27, 2023 · Port Number: The default LDAP over TLS port number is TCP 636. For example: Interoperable Kerberos clients use the Kerberos protocols. That's the bottom line of the matter. The full list of ports needed by Active Directory is detailed in this Microsoft document: Active Directory and Active Directory Domain Services Port Requirements When Active Directory authentication is configured, the MR queries the Global Catalog over TCP port 3268. The Connector Appliance requires an outbound connection to the Active Directory domain via the following ports: The NTDS interface is also known as the DRS interface. Authentication port UDP 137. 7. Section Contrôleurs de domaine et Active Directory dans l’article Vue d’ensemble des services et exigences de ports réseau pour Windows. Active Directory port 3269(I f a Global Catalog is configured) Active Directory DNS port 53; Active Directory Replication, Login services port 445; Kerberos Passwords, port 464; Authentication port UDP 137; Authentication port TCP 137; The following diagram illustrates firewalls in place between IdentityIQ/Virtual Appliance components and Feb 28, 2024 · Ports: Description: 53 (TCP/UDP) Needed for DNS lookups on the destination forest. That's exactly what you should get. Feb 9, 2024 · Connector Appliance with Active Directory . For AD Connector to redirect directory requests to your existing Active Directory domain controllers, the firewall for your existing network must have the following ports open to the CIDRs for both subnets in your Amazon VPC. Below is the list of all ports in the Active Directory with a short description of the role. Aug 20, 2023 · Checking open ports can be done using built-in tools like Command Prompt or PowerShell, which list active ports and the associated process names or identifiers. These ports are also known as random RPC ports. As stated earlier in this article, different protocols are used in different circumstances. Make sure the following Active Directory Firewall ports are open between the servers. May 7, 2024 · When a managed domain is configured for secure LDAP on TCP port 636, three rules are created and used on a load balancer to distribute the traffic. When NLA starts to detect the network location, the machine will contact a domain controller via port 389. UDP port 1645 for RADIUS authentication messages 3. : 88 (TCP/UDP) Needed for Kerberos authentication to the AD forest. TCP/UDP. Jun 26, 2024 · The Windows Server contains Active Directory and the KDC in the domain rhbk-demo. If you define a custom port, use that custom port in the IP filter information for IPsec policies or to configure firewalls. UDP and TCP Port 135 for domain controllers-to-domain controller and client to domain controller operations. You can then link the Group Policy Object to an Active Directory container or site, or apply it to individual systems. Feb 2, 2016 · This is the document you are looking for: Active Directory and Active Directory Domain Services Port Requirements Default dynamic port range. If you intend to create a trust relationship between Managed Microsoft AD and an on-premises Active Directory, the entire article applies. Dec 26, 2023 · Contrôleurs de domaine et Active Directory. Follow edited Sep 25, 2017 at 15:13. Sans agent Aug 14, 2019 · Hi, I have been running Netstat on client Domain Controllers and I see that they are all listening on port 42 and Wins Service is running. Click OK. Active Directory port 3268. Aug 8, 2013 · The Active Directory Domain Service administration tools still use port 389, but they are protected by the sign and seal binding. 1. Active Directory Web Services 9389. Jun 13, 2024 · Before proceeding, you should locate (or set up) a system in your environment on which you will install the Duo Authentication Proxy. . This request is being rejected by the Company Security and Firewall team. TCP and UDP Port 464 for Kerberos Password Change In the case of a single Active Directory site, even if it contains multiple domains, a single Global Catalog server is usually sufficient to process Active Directory requests. fv xo yu fs cf ct zr te bd rh