This is excellent; I've been looking for something like this as well. Thanks for making it available.

I really do hope that this is the definitive guide as I have never found anything that is definitive, not even on the MS support site.

Good work! Thank you!

Sweet, thanks!

I've used this, combined with Microsoft's info on how to restrict RPC services to a limited port list (5000-5100 in this case), and with the power of MS Excel (quick incrementing of port #'s) have created this that can be cut/paste into a command prompt window... I may have missed some, and you may want services open to more that just your subnet (or 3389 RDP not open to all ips) so use at your own risk ;-)

commands start here:
------------------------
netsh firewall add portopening tcp 3389 139_tcp_AD_PORTS enable
netsh firewall add portopening tcp 139 139_tcp_AD_PORTS enable subnet
netsh firewall add portopening tcp 445 445_tcp_AD_PORTS enable subnet
netsh firewall add portopening udp 137 137_udp_AD_PORTS enable subnet
netsh firewall add portopening udp 138 138_udp_AD_PORTS enable subnet
netsh firewall add portopening tcp 53 53_tcp_AD_PORTS enable subnet
netsh firewall add portopening udp 53 53_udp_AD_PORTS enable subnet
netsh firewall add portopening tcp 42 42_tcp_AD_PORTS enable subnet
netsh firewall add portopening udp 42 42_udp_AD_PORTS enable subnet
netsh firewall add portopening tcp 137 137_tcp_AD_PORTS enable subnet
netsh firewall add portopening tcp 1025 1025_tcp_AD_PORTS enable subnet
netsh firewall add portopening tcp 123 123_tcp_AD_PORTS enable subnet
netsh firewall add portopening udp 123 123_udp_AD_PORTS enable subnet
netsh firewall add portopening tcp 507 507_tcp_AD_PORTS enable subnet
netsh firewall add portopening udp 750 750_udp_AD_PORTS enable subnet
netsh firewall add portopening tcp 88 88_tcp_AD_PORTS enable subnet
netsh firewall add portopening udp 88 88_udp_AD_PORTS enable subnet
netsh firewall add portopening tcp 464 464_tcp_AD_PORTS enable subnet
netsh firewall add portopening udp 464 464_udp_AD_PORTS enable subnet
netsh firewall add portopening udp 389 389_udp_AD_PORTS enable subnet
netsh firewall add portopening udp 636 636_udp_AD_PORTS enable subnet
netsh firewall add portopening udp 445 445_udp_AD_PORTS enable subnet
netsh firewall add portopening udp 161 161_udp_AD_PORTS enable subnet
netsh firewall add portopening tcp 162 162_tcp_AD_PORTS enable subnet
netsh firewall add portopening tcp 42424 42424_tcp_AD_PORTS enable subnet
netsh firewall add portopening tcp 5000 5000_tcp_AD_PORTS enable subnet
netsh firewall add portopening tcp 5001 5001_tcp_AD_PORTS enable subnet

.... ports omitted due to post size limitations (tcp 5002-5099) ...

netsh firewall add portopening tcp 5100 5100_tcp_AD_PORTS enable subnet
netsh firewall add portopening udp 5000 5000_udp_AD_PORTS enable subnet
netsh firewall add portopening udp 5001 5001_udp_AD_PORTS enable subnet

.... more ports omitted due to post size limitations (udp 5002-5099) ...

netsh firewall add portopening udp 5100 5100_udp_AD_PORTS enable subnet

Very handy. Thanks!

thanks a lot very usful

This helped me out a great deal, thanks a lot!

Thanks mate - worked like a charm ^.^

It's always good to see a list of errors suddenly disapear. lol.

That's great, I never thought about Active Directory like that before.

Wow, I never knew that Active Directory . That's pretty interesting…

Very good information on all tech peoples

Thanks a lot

Try Microsofts official web page for info...
http://technet.microsoft.com/en-us/library/dd772723(WS.10).aspx

Does anyone know what firewall ports have to be opened between a
client device and a server that is part of a Windows Active Directory
Domain.


In my example the client is NOT in the same domain as the server.


The Windows 2003 server that is part of the domain does not have the NetBIOS over TCP/IP service installed in its networking configuration. However the client "might" have this service as it might be a Windows 2000 server, or Windows 2003 server with the NetBIOS service installed.


Therefore do I need to open ports:
135 (RPC)
137, 138, 139 (NetBIOS)
1024-65535 (which I can limit to 5000-6000) RPC dynamic ports
53 (DNS)
389/636 (LDAP/Secure LDAP)
3268 (Global Catalog)


OR do I just need:
135 (RPC)
1024-65535 (which I can limit to 5000-6000) RPC dynamic ports


I have read all sorts of pages on the internet that discuss client to
server comms but they all assume the client is in the same domain as
the server. In my case they are not.
Personally I don't see why the client, who is not in the domain,
needs to be able to communicate over the DNS and Global Catalog and
LDAP ports because it is NOT the one authenticating the user, it is
the server, so obviously the server needs those ports opened up to its
domain controllers. Also it doesn't need the NetBIOS ports as the Windows 2003 server does not have the NetBIOS over TCP/IP service installed (regardless of whether the client has it or not)


Many thanks

Terima kasih :)

i need all ports activ directory for on firewall

port number

l like this article~~
cool~~
thanks for your sharing!!!
I am sure that all visitors will find that very useful

Thanks for the useful information.

Thanks so much for providing individuals with such a spectacular possiblity to read critical reviews from this web site. It is always very useful and also full of amusement for me personally and my office acquaintances to visit your web site no less than three times weekly to read the fresh guidance you have got. Of course, we are usually amazed for the surprising things served by you. Selected 3 tips in this post are clearly the finest we’ve had.

Bless you Pal. This was very helpful when I was working on a firewall.

hi please find this

Oh, man. I had a weekend. We went down to, uh, Tijuana, Mexico, ya know. And there was this guy there and he was all, "Hey, you gotta come and check out one of these shows." And, you know, it's a woman fuckin' a horse. And you get there and you're thinking "Oh, a woman fuckin' a horse." And you get there, and it is not as a great as you thought it would be. It's kinda gross. I mean, it was really givin' it to her. To be honest, we all just felt bad for her. Kinda felt bad for the horse.