The Global Catalog wrapped in TLS from the first byte — LDAPS for the whole forest.
Port 3269 is the TLS-on-connect version of the Active Directory Global Catalog, standing in the same relation to 3268 as LDAPS on 636 does to LDAP on 389. Clients that must not send a bind in the clear — Exchange, directory-integrated applications, identity sync agents — point at 3269 and validate the DC's certificate. Only domain controllers holding the Global Catalog role listen, and the certificate they present is the fastest way to confirm which DC you reached.
Do not expose
TLS fixes eavesdropping, not exposure: a reachable domain controller is a credential-guessing and enumeration target regardless of encryption. Keep it internal or behind a VPN.
$ openssl s_client -connect DC_HOST:3269 -brief </dev/nullSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.