Port reference
Port 9389 (TCP) – Active Directory Web Services (ADWS)
ADWS — the SOAP web-service interface that the PowerShell AD module and admin tools use to query and manage Active Directory.
Quick facts
- Transport
- tcp
- Category
- Registered
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on Windows domain controllers running the Active Directory Web Services role, enabled by default since Windows Server 2008 R2.
What is port 9389 used for?
Port 9389 carries Active Directory Web Services (ADWS), a SOAP-based web service that Windows domain controllers expose for querying and managing Active Directory. It is the channel behind the PowerShell Active Directory module (Get-ADUser, Get-ADGroup, and the rest) and admin tools like the Active Directory Administrative Center (ADAC). Enabled by default since Windows Server 2008 R2, it surfaces the same directory data available over LDAP on port 389, just through a different protocol.
When would you open it?
This port is already open on domain controllers running ADWS. You would allow it through firewalls between your administrative workstations and domain controllers so admins can run PowerShell AD cmdlets and management consoles remotely. There is no reason to expose it beyond your internal admin networks.
Is it safe to open?
Within a domain it is a normal management service, but because it exposes the full directory, it should be reachable only from trusted admin hosts. Restrict it to jump hosts and tiered admin networks and monitor it like LDAP. See the security notes below.
How to check if this port is open
ss -tulpn | grep :9389
nmap -p 9389 <target>netstat -ano | findstr :9389
Test-NetConnection <host> -Port 9389lsof -i :9389
nmap -p 9389 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 9389 to your device's local IP, internal port 9389, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 9389/tcpsudo firewall-cmd --permanent --add-port=9389/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9389 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 9389" -Direction Inbound -Protocol TCP -LocalPort 9389 -Action AllowSecurity & risks
Common attacks
- Stealthy directory enumeration via SOAPHound to evade LDAP detections
- Reconnaissance with the PowerShell AD module (Get-AD* cmdlets)
- Privilege and ACL discovery for attack-path mapping
- Abuse of administrative write operations after credential theft
Hardening
- Restrict TCP 9389 to administrative jump hosts and tiered admin networks
- Monitor ADWS/SOAP queries the way you monitor LDAP enumeration
- Apply least privilege so low-tier accounts cannot enumerate broadly
- Keep domain controllers patched and audit AD management tooling
- Alert on SOAPHound-style query patterns and bulk object reads
How to block this port
sudo ufw deny 9389/tcpsudo firewall-cmd --permanent --remove-port=9389/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 9389 -j DROPNew-NetFirewallRule -DisplayName "Block 9389" -Direction Inbound -Protocol TCP -LocalPort 9389 -Action Blocknmap snippet
nmap -p9389 --script banner <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 9389 used for?
- Port 9389 is Active Directory Web Services (ADWS), the SOAP interface that the PowerShell Active Directory module and tools like ADAC use to query and manage AD on a domain controller.
- Why do attackers like ADWS?
- ADWS offers the same directory data as LDAP but over SOAP. Tools like SOAPHound use it to enumerate AD while evading the LDAP-focused detections many defenders rely on.