{
  "port": 3268,
  "protocol": "tcp",
  "service": "Microsoft Global Catalog (LDAP)",
  "oneLiner": "Active Directory's forest-wide LDAP view — every domain in the forest, one query, in cleartext.",
  "whatItIs": "A domain controller promoted as a Global Catalog answers LDAP on 3268 in addition to normal LDAP on 389. The difference is scope: 389 serves that DC's own domain, while 3268 serves a partial, read-only replica of every object in the entire forest, which is why Exchange and address-book lookups target it. It is plain LDAP — no TLS unless the client negotiates STARTTLS — and it appears on any scan of a Windows DC that holds the GC role.",
  "exposure": {
    "verdict": "never",
    "note": "A simple bind here sends credentials in cleartext and the response can enumerate the whole forest; keep domain controllers off the internet and use 3269 or STARTTLS internally."
  },
  "checkCommand": "ldapsearch -x -H ldap://DC_HOST:3268 -s base -b \"\" namingContexts",
  "links": [
    {
      "title": "Microsoft Learn — Global Catalog",
      "url": "https://learn.microsoft.com/en-us/windows/win32/ad/global-catalog",
      "kind": "official-docs"
    },
    {
      "title": "Microsoft — Configure firewall for AD domains and trusts (port requirements)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}