# WHATPORT(464)

## NAME

port 464 — Kerberos kpasswd (password change) — The Kerberos change-password service — on a Windows network, a domain controller sitting next to port 88.

Protocol: TCP/UDP  
IANA: kpasswd

## DESCRIPTION

Port 464 carries the Kerberos password change and set protocol: a client presents a ticket obtained from the KDC and submits a new password, over both UDP and TCP. RFC 3244 specifies the Microsoft variant that adds administrative set-password, which is what Active Directory uses. Every AD domain controller listens here, as do MIT krb5 and Heimdal KDCs configured with kadmind. Finding 464 open alongside 88, 389 and 445 is the standard signature of a domain controller.

## EXPOSURE

**Do not expose.** A domain controller's password-change endpoint is a credential surface and part of the identity plane — it belongs on internal networks reachable only by domain members.

## CHECK

```sh
nmap -p 88,389,445,464 -sV TARGET
```

## SEE ALSO

- spec — [RFC 3244 — Microsoft Windows 2000 Kerberos Change Password and Set Password Protocols](https://www.rfc-editor.org/rfc/rfc3244.html) (rfc-editor.org)
- docs — [MIT Kerberos — kdc.conf reference (kpasswd listener configuration)](https://web.mit.edu/kerberos/krb5-latest/doc/admin/conf_files/kdc_conf.html) (web.mit.edu)
- docs — [Microsoft — Service overview and network port requirements for Windows](https://learn.microsoft.com/en-us/troubleshoot/windows-server/networking/service-overview-and-network-port-requirements) (learn.microsoft.com)
- iana — [IANA Service Name and Transport Protocol Port Number Registry — 464](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=464) (iana.org)

---

HTML: <https://whatport.net/464/> · JSON: <https://whatport.net/464.json> · full dataset: <https://whatport.net/ports.json>