WHATPORT(3268) whatport.net WHATPORT(3268)
3268

Microsoft Global Catalog (LDAP)

Active Directory's forest-wide LDAP view — every domain in the forest, one query, in cleartext.

TCP IANA registry

Description

A domain controller promoted as a Global Catalog answers LDAP on 3268 in addition to normal LDAP on 389. The difference is scope: 389 serves that DC's own domain, while 3268 serves a partial, read-only replica of every object in the entire forest, which is why Exchange and address-book lookups target it. It is plain LDAP — no TLS unless the client negotiates STARTTLS — and it appears on any scan of a Windows DC that holds the GC role.

Exposed to the internet?

Do not expose

A simple bind here sends credentials in cleartext and the response can enumerate the whole forest; keep domain controllers off the internet and use 3269 or STARTTLS internally.

Check it yourself

$ ldapsearch -x -H ldap://DC_HOST:3268 -s base -b "" namingContexts

See also

Seen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.

Get Beige Box →

also available as JSON · Markdown

Corrections or a missing port? Reply @rimrocksystems.