Domain Controller Replication Ports
Tcp and udp port 464 kerberos password change.
Domain controller replication ports. Both udp and tcp port 135 are required for communication between domain controllers and clients to domain controllers. The domain controllers and active directory section in service overview and network port requirements for windows. The frs rpc port should use a different port.
Udp and tcp port 135 for domain controllers to domain controller and client to domain controller operations. These ports relate to active directory and you should only need to open them if you do not have a global catalog gc or domain controller dc in your dmz. Do not assume that clients only use the netlogon rpc services and thus only the setting dctcpipport is required.
The new default start port is 49152 and the default end port is 65535. Tcp port 3268 and 3269 global catalog from client to domain controller. Simple mail transfer protocol smtp can be used in certain situations schema configuration and global catalog replication but not domain naming context limiting its usefulness.
This is applicable for restriction ad replication to a specific port range. Tcp and udp port 53 dns from client to domain controller and domain controller to domain controller. There might be some rpc ports that you need to open in addition and that question is probably best answered by your microsoft technical account manager.
Udp port 389 for ldap to handle normal queries from client computers to the domain controllers. Fixed port for sysvol replication to tcp 51000 dfsrdiag staticrpc port 51000 restart ad domain controller for the changes to take affected and change the firewall rule to allow only tcp 50 000 51 000 as below verification that fixed ports are working. Tcp and udp port 445 file replication service.
Modify registry to select a static port. Tcp port 139 and udp 138 network ports are used by the sysvol replication service to replicate contents of sysvol folder. Therefore you must increase the rpc port range in your firewalls.