DC non-standard LDAP port count should be retrievable
AD-DCD-01InfoActive DirectoryDomain controllers
Part of Active Directory · Active Directory · Domain controllers · All checks
Invoke-Maester -TestId AD-DCD-01Overview
Section titled “Overview”Domain controllers typically use the standard LDAP port (389) for directory services communication. Non-standard LDAP ports may indicate:
- Custom configurations that could affect compatibility with standard LDAP clients and tools
- Security evasion attempts where alternate ports are used to bypass network monitoring
- Legacy configurations that haven’t been updated to standard settings
- Multi-tenant or specialized deployments with unique port requirements
While non-standard ports may be intentional for specific scenarios, they can cause issues with:
- LDAP client connectivity
- Directory synchronization services
- Authentication protocols expecting standard ports
- Network security monitoring and firewall rules
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Document intentional deviations: If non-standard ports are required, ensure they are well-documented with business justification
- Review firewall rules: Ensure proper firewall rules are in place for any non-standard ports
- Monitor for unauthorized changes: Non-standard ports without documentation may indicate unauthorized configuration changes
- Consider standardization: Where possible, use standard ports to simplify management and troubleshooting
How the Test Works
Section titled “How the Test Works”This test retrieves all domain controllers and checks their configured LDAP port. The standard LDAP port is 389. The test reports:
- Total number of domain controllers
- Number of DCs using the standard LDAP port (389)
- Number of DCs using non-standard LDAP ports
- Names of DCs with non-standard ports and the specific ports they use
Related Tests
Section titled “Related Tests”Test-MtAdDcNonStandardLdapsPortCount- Checks for non-standard secure LDAP portsTest-MtAdDcSiteCoverageCount- Analyzes DC distribution across sites
Details
Section titled “Details”Every attribute of this check
| Field | Value |
|---|---|
| Test ID | AD-DCD-01 |
| Severity | Info |
| Suite | Active Directory |
| Product | Active Directory |
| Feature | Domain controllers |
| Area | Infrastructure hardening |
| Resource type | DomainController |
| MITRE ATT&CK | None |
| PowerShell test | Test-MtAdDcNonStandardLdapPortCount |
| Services | ActiveDirectory |
| Permissions | ActiveDirectory:Ldap:nTDSDSA:ReadProperty |