Port reference
Port 593 (TCP) – RPC over HTTP (MSRPC/EPMAP)
Microsoft RPC endpoint mapper over HTTP — tunnels DCE/RPC calls for Exchange and AD services.
Quick facts
- Transport
- tcp
- Category
- Well-known
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Windows hosts running RPC-over-HTTP services such as Exchange RPC Proxy and some AD roles, sometimes reachable from outside.
What is port 593 used for?
Port 593 carries Microsoft RPC over HTTP, also called the EPMAP endpoint mapper. It does the same job as TCP 135 — telling a client which port a given RPC service listens on — but tunnels the calls over HTTP so they can pass through proxies and firewalls. In practice it is used by Microsoft Exchange and Active Directory, most famously by the old Outlook Anywhere (RPC-over-HTTP) feature that let Outlook connect to Exchange across the internet.
When would you open it?
You only open port 593 if you run Windows Server roles that need RPC-over-HTTP, such as a legacy Exchange RPC Proxy serving remote Outlook clients. On modern deployments this is rarely required, since newer access methods have replaced it. Open it only on the hosts that actually provide the service.
Is it safe to open?
Exposing 593 to untrusted networks is risky because RPC interfaces are a known target for authentication relay, so keep it internal and reach it over a VPN. See the security notes below.
How to check if this port is open
ss -tulpn | grep :593
nmap -p 593 <target>netstat -ano | findstr :593
Test-NetConnection <host> -Port 593lsof -i :593
nmap -p 593 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 593 to your device's local IP, internal port 593, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 593/tcpsudo firewall-cmd --permanent --add-port=593/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 593 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 593" -Direction Inbound -Protocol TCP -LocalPort 593 -Action AllowSecurity & risks
Common attacks
- NTLM relay against coerced RPC authentication
- PetitPotam-style authentication coercion (MS-EFSRPC)
- Endpoint mapper enumeration of exposed RPC interfaces
- Lateral movement via relayed machine accounts to AD CS/LDAP
Hardening
- Block 593 from untrusted networks; keep RPC internal
- Enable Extended Protection for Authentication (EPA) and SMB/LDAP signing
- Patch PetitPotam and PrintNightmare-class coercion bugs
- Disable NTLM where possible; prefer Kerberos
- Segment AD CS and tier-0 services off general access
How to block this port
sudo ufw deny 593/tcpsudo firewall-cmd --permanent --remove-port=593/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 593 -j DROPNew-NetFirewallRule -DisplayName "Block 593" -Direction Inbound -Protocol TCP -LocalPort 593 -Action Blocknmap snippet
nmap -p593 --script rpc-grind <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- How is port 593 different from port 135?
- Port 135 is the classic DCE/RPC endpoint mapper over TCP; port 593 is the same endpoint-mapper function tunnelled over HTTP, letting RPC traverse proxies and firewalls.
- Should port 593 be exposed to the internet?
- No. Exposed RPC-over-HTTP is a coercion and NTLM-relay surface. Keep it internal and front any remote access with a VPN or modern gateway.