# WHATPORT(3269)

## NAME

port 3269 — Microsoft Global Catalog over TLS — The Global Catalog wrapped in TLS from the first byte — LDAPS for the whole forest.

Protocol: TCP  
IANA registry

## DESCRIPTION

Port 3269 is the TLS-on-connect version of the Active Directory Global Catalog, standing in the same relation to 3268 as LDAPS on 636 does to LDAP on 389. Clients that must not send a bind in the clear — Exchange, directory-integrated applications, identity sync agents — point at 3269 and validate the DC's certificate. Only domain controllers holding the Global Catalog role listen, and the certificate they present is the fastest way to confirm which DC you reached.

## EXPOSURE

**Do not expose.** TLS fixes eavesdropping, not exposure: a reachable domain controller is a credential-guessing and enumeration target regardless of encryption. Keep it internal or behind a VPN.

## CHECK

```sh
openssl s_client -connect DC_HOST:3269 -brief </dev/null
```

## SEE ALSO

- docs — [Microsoft — Configure firewall for AD domains and trusts (port requirements)](https://learn.microsoft.com/en-us/troubleshoot/windows-server/active-directory/config-firewall-for-ad-domains-and-trusts) (learn.microsoft.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml) (iana.org)

---

HTML: <https://whatport.net/3269/> · JSON: <https://whatport.net/3269.json> · full dataset: <https://whatport.net/ports.json>