Windows 2000 Active Directory LDAP Port

Microsoft Windows 2000 Active Directory primarily uses TCP and UDP port 389 for standard Lightweight Directory Access Protocol (LDAP) authentication and directory queries. When encrypted communication is required, LDAP over SSL (LDAPS) uses TCP port 636. Additionally, queries targeted specifically at the Active Directory Global Catalog use specialized alternative ports depending on whether the traffic is encrypted or unencrypted.

Primary LDAP Ports

• Port 389 (TCP/UDP): This is the default port for standard LDAP traffic in Windows 2000 Active Directory. Client systems use port 389 to connect, search the directory, and perform simple LDAP binds for authentication. Both TCP and UDP are used, though TCP handles the majority of directory transactions and authentication requests.
• Port 636 (TCP): This port is dedicated to LDAPS (LDAP over SSL). It provides encrypted authentication and directory communication to prevent credentials and directory data from being intercepted over the network in clear text.

Global Catalog Ports

In a multi-domain Windows 2000 Active Directory forest, domain controllers designated as Global Catalog servers host a searchable partial replica of every object in the forest. These servers use distinct ports:

• Port 3268 (TCP): Used for standard, unencrypted LDAP queries to the Global Catalog.
• Port 3269 (TCP): Used for encrypted LDAPS queries to the Global Catalog over SSL.

Authentication Considerations

While LDAP authentication occurs over port 389 (or 636), Windows 2000 Active Directory natively defaults to Kerberos v5 for network user and computer authentication, which operates over TCP/UDP port 88. LDAP authentication on port 389 is commonly utilized when legacy applications, non-Windows clients, or services perform direct LDAP simple binds to validate user credentials against the directory.