Port reference
Port 3269 (TCP) – LDAP Global Catalog over SSL/TLS
Global Catalog over TLS — encrypted, forest-wide LDAP queries against Active Directory's partial replica of every domain.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on domain controllers that hold the Global Catalog role. Encrypted counterpart to plaintext GC port 3268.
What is port 3269 used for?
Port 3269 carries the Active Directory Global Catalog over SSL/TLS — the encrypted version of the Global Catalog that listens in cleartext on port 3268. The Global Catalog is a domain-controller role holding a searchable, forest-wide index of every object across all domains, and apps like Microsoft Outlook/Exchange and other directory-aware tools query it over the secure 3269 port for fast lookups. It is to 3268 what encrypted LDAPS (636) is to plain LDAP (389).
When would you open it?
You allow 3269 within an Active Directory environment so Exchange servers, domain controllers, and applications that need encrypted forest-wide directory lookups can reach the Global Catalog. It stays on the internal network between trusted servers and domain controllers.
Is it safe to open?
The encryption protects data in transit, but the Global Catalog still exposes the whole forest, so it should never face the internet. Enforce LDAP signing and channel binding, disable anonymous binds, use valid certificates, and keep it internal. See the security notes below.
How to check if this port is open
ss -tulpn | grep :3269
nmap -p 3269 <target>netstat -ano | findstr :3269
Test-NetConnection <host> -Port 3269lsof -i :3269
nmap -p 3269 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 3269 to your device's local IP, internal port 3269, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 3269/tcpsudo firewall-cmd --permanent --add-port=3269/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3269 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 3269" -Direction Inbound -Protocol TCP -LocalPort 3269 -Action AllowSecurity & risks
Common attacks
- Forest-wide directory enumeration (users, groups, SPNs across domains)
- NTLM relay to the Global Catalog to modify directory objects
- BloodHound-style attack-path mapping across the whole forest
- Certificate spoofing / MITM against clients that skip validation
Hardening
- Enforce LDAP signing and channel binding to defeat relay
- Restrict 3269 to trusted management and application networks
- Disable anonymous binds and audit Global Catalog queries
- Use valid CA-issued certificates and require clients to validate them
- Monitor for bulk LDAP reads spanning multiple domains
How to block this port
sudo ufw deny 3269/tcpsudo firewall-cmd --permanent --remove-port=3269/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 3269 -j DROPNew-NetFirewallRule -DisplayName "Block 3269" -Direction Inbound -Protocol TCP -LocalPort 3269 -Action Blocknmap snippet
nmap -p3269 --script ldap-rootdse,ssl-cert <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is the difference between port 3268 and 3269?
- Both serve the Active Directory Global Catalog — forest-wide LDAP. Port 3268 is cleartext, while 3269 wraps the same queries in SSL/TLS for encryption.
- Why is the Global Catalog a high-value target?
- The Global Catalog holds a searchable partial copy of every object in the entire AD forest, so a single query can enumerate accounts, groups, and trust relationships across all domains.