Active Directory's forest-wide LDAP view — every domain in the forest, one query, in cleartext.
A domain controller promoted as a Global Catalog answers LDAP on 3268 in addition to normal LDAP on 389. The difference is scope: 389 serves that DC's own domain, while 3268 serves a partial, read-only replica of every object in the entire forest, which is why Exchange and address-book lookups target it. It is plain LDAP — no TLS unless the client negotiates STARTTLS — and it appears on any scan of a Windows DC that holds the GC role.
Do not expose
A simple bind here sends credentials in cleartext and the response can enumerate the whole forest; keep domain controllers off the internet and use 3269 or STARTTLS internally.
$ ldapsearch -x -H ldap://DC_HOST:3268 -s base -b "" namingContextsSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.