{
  "port": 3269,
  "protocol": "tcp",
  "service": "Microsoft Global Catalog over TLS",
  "oneLiner": "The Global Catalog wrapped in TLS from the first byte — LDAPS for the whole forest.",
  "whatItIs": "Port 3269 is the TLS-on-connect version of the Active Directory Global Catalog, standing in the same relation to 3268 as LDAPS on 636 does to LDAP on 389. Clients that must not send a bind in the clear — Exchange, directory-integrated applications, identity sync agents — point at 3269 and validate the DC's certificate. Only domain controllers holding the Global Catalog role listen, and the certificate they present is the fastest way to confirm which DC you reached.",
  "exposure": {
    "verdict": "never",
    "note": "TLS fixes eavesdropping, not exposure: a reachable domain controller is a credential-guessing and enumeration target regardless of encryption. Keep it internal or behind a VPN."
  },
  "checkCommand": "openssl s_client -connect DC_HOST:3269 -brief </dev/null",
  "links": [
    {
      "title": "Microsoft — Configure firewall for AD domains and trusts (port requirements)",
      "url": "https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts",
      "kind": "official-docs"
    },
    {
      "title": "IANA Service Name and Transport Protocol Port Number Registry",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml",
      "kind": "iana"
    }
  ]
}