Port 3268: Active Directory Global Catalog
TCP port 3268 is the standard Active Directory Global Catalog query port. It lets a client search the Global Catalog across an AD forest. Microsoft documents TCP 3269 for the SSL-protected Global Catalog service; do not treat 3268 as an internet-facing public directory service.
Port 3268 at a glance
| Property | Value |
|---|---|
| Primary deployed transport | TCP |
| Service | Microsoft Active Directory Global Catalog |
| Typical scope | Clients/applications to a Global Catalog domain controller inside trusted networks |
| Encrypted counterpart | TCP 3269 (Global Catalog over SSL/TLS) |
3268 versus LDAP ports 389, 636 and 3269
| Port | Directory use | Protection |
|---|---|---|
389/TCP | LDAP to a domain directory partition | Plain LDAP or LDAP with negotiated protection such as StartTLS/signing, depending on configuration |
636/TCP | LDAP over SSL/TLS | TLS from connection start |
3268/TCP | Global Catalog query across the forest | Not the SSL port |
3269/TCP | Global Catalog over SSL/TLS | TLS from connection start |
A Global Catalog contains searchable information needed for forest-wide discovery. An application should use the port and security mode its vendor and AD design require; substituting ports without testing can change search scope or break authentication.
Check whether a Global Catalog is reachable
- Confirm DNS resolves the intended domain controller and that it is designated as a Global Catalog.
- From Windows PowerShell, run
Test-NetConnection dc01.example.local -Port 3268. This checks the TCP path, not the correctness of an LDAP query. - On the server, inspect the listener with
Get-NetTCPConnection -LocalPort 3268 -State Listen. - Use
nltest /dsgetdc:example.local /GCin an authorised AD environment to discover a Global Catalog candidate. - Test the application’s bind identity, base DN, search filter and required attributes separately from network reachability.
Troubleshooting sequence
If port 3268 times out, check routing and the firewalls between the client and the selected domain controller. If the TCP test succeeds but the directory search fails, investigate credentials, LDAP signing/channel-binding policy, certificates when using 3269, search scope and replication health. A successful port test does not prove the Global Catalog has the data or permissions the application expects.
Keep 3268/3269 inside the network paths that genuinely require directory access. Do not open the service to the public internet. If access crosses sites or cloud networks, limit sources and destinations, log the rule and review whether a private tunnel or identity-aware application path is more appropriate.
Frequently asked questions
What is port 3268 used for?
TCP 3268 is used for Microsoft Active Directory Global Catalog queries, allowing forest-wide directory searches through a Global Catalog domain controller.
What is the difference between ports 3268 and 3269?
3268 is the standard Global Catalog query port; 3269 is the Global Catalog SSL/TLS port. Use the mode required by the application and the organisation’s directory-security policy.
What is the difference between LDAP 389 and Global Catalog 3268?
Port 389 queries LDAP on a domain controller, while 3268 queries the Global Catalog for forest-wide searchable information. Their search scope and available attributes can differ.
Should port 3268 be open to the internet?
No. Restrict it to trusted clients and required domain controllers over controlled network paths. Prefer protected directory connections and follow the organisation’s Active Directory security policy.
Primary sources
- Microsoft: Windows service overview and network port requirements
- Microsoft: configure a firewall for Active Directory domains and trusts
- IANA registry entry for Microsoft Global Catalog
Port registrations describe assigned names, not a guarantee about the process actually listening on a device. Confirm the local process and configuration before changing a firewall.
Related guides
Practise the diagnosis, not only the port number
Use an authorised lab to identify the listener, inspect packets and test the firewall path. Attila teaches these troubleshooting habits with networking and security labs in Ahmedabad.