Port reference
Port 9389 (TCP) – Active Directory Web Services (ADWS)
ADWS — the SOAP web-service interface that the PowerShell AD module and admin tools use to query and manage Active Directory.
Default state
Open on Windows domain controllers running the Active Directory Web Services role, enabled by default since Windows Server 2008 R2.
Common attacks
- Stealthy directory enumeration via SOAPHound to evade LDAP detections
- Reconnaissance with the PowerShell AD module (Get-AD* cmdlets)
- Privilege and ACL discovery for attack-path mapping
- Abuse of administrative write operations after credential theft
Hardening
- Restrict TCP 9389 to administrative jump hosts and tiered admin networks
- Monitor ADWS/SOAP queries the way you monitor LDAP enumeration
- Apply least privilege so low-tier accounts cannot enumerate broadly
- Keep domain controllers patched and audit AD management tooling
- Alert on SOAPHound-style query patterns and bulk object reads
nmap snippet
nmap -p9389 --script banner <target>Replace <target> with the host or range you're authorized to scan.
What runs on port 9389?
Port 9389 carries Active Directory Web Services (ADWS), a SOAP-based web
service that domain controllers expose for AD queries and management. It is the
channel behind the PowerShell Active Directory module (Get-ADUser,
Get-ADGroup, and the rest) and tools like the Active Directory Administrative
Center. Enabled by default since Windows Server 2008 R2, ADWS surfaces the same
directory information available over LDAP on 389, just through a different
protocol.
Why it matters for security
Because ADWS reaches the same directory data as LDAP but over SOAP, it gives attackers an alternate, lower-noise path for reconnaissance. Many detection rules focus on raw LDAP traffic and miss equivalent queries arriving on 9389. An attacker with any domain foothold can enumerate users, groups, ACLs, and privilege relationships to plan escalation, and with stolen admin credentials can drive management write operations through the same interface.
How it's attacked
The tool SOAPHound queries ADWS to enumerate Active Directory while evading LDAP-based detections — collecting the same data BloodHound consumes but over SOAP. Attackers also use the built-in PowerShell AD module for hands-on-keyboard reconnaissance, mapping privileges and ACLs, then abuse administrative cmdlets once they hold sufficient rights.
Hardening checklist
Restrict TCP 9389 to administrative jump hosts and tiered admin networks so it is not broadly reachable. Monitor ADWS/SOAP queries alongside LDAP enumeration so the alternate path is not a blind spot, and watch for SOAPHound-style bulk reads. Apply least privilege so low-tier accounts cannot enumerate the directory broadly, keep domain controllers patched, and audit AD management tooling. The nmap banner check above confirms exposure on hosts you are authorised to test. </content>
Related ports
Frequently asked questions
- What is port 9389 used for?
- Port 9389 is Active Directory Web Services (ADWS), the SOAP interface that the PowerShell Active Directory module and tools like ADAC use to query and manage AD on a domain controller.
- Why do attackers like ADWS?
- ADWS offers the same directory data as LDAP but over SOAP. Tools like SOAPHound use it to enumerate AD while evading the LDAP-focused detections many defenders rely on.