# WHATPORT(3268)

## NAME

port 3268 — Microsoft Global Catalog (LDAP) — Active Directory's forest-wide LDAP view — every domain in the forest, one query, in cleartext.

Protocol: TCP  
IANA registry

## DESCRIPTION

A domain controller promoted as a Global Catalog answers LDAP on 3268 in addition to normal LDAP on 389. The difference is scope: 389 serves that DC's own domain, while 3268 serves a partial, read-only replica of every object in the entire forest, which is why Exchange and address-book lookups target it. It is plain LDAP — no TLS unless the client negotiates STARTTLS — and it appears on any scan of a Windows DC that holds the GC role.

## EXPOSURE

**Do not expose.** A simple bind here sends credentials in cleartext and the response can enumerate the whole forest; keep domain controllers off the internet and use 3269 or STARTTLS internally.

## CHECK

```sh
ldapsearch -x -H ldap://DC_HOST:3268 -s base -b "" namingContexts
```

## SEE ALSO

- docs — [Microsoft Learn — Global Catalog](https://learn.microsoft.com/en-us/windows/win32/ad/global-catalog) (learn.microsoft.com)
- docs — [Microsoft — Configure firewall for AD domains and trusts (port requirements)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts) (learn.microsoft.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/3268/> · JSON: <https://whatport.net/3268.json> · full dataset: <https://whatport.net/ports.json>