Skip to main content
IMMUNITYSEC

Port 3268: Active Directory Global Catalog (LDAP)

TCP 3268 serves LDAP queries against the Active Directory global catalog on domain controllers that hold the global catalog role. The global catalog contains a partial replica of every naming context in the forest, which lets clients find objects across domains. Microsoft's port reference lists Global Catalog on TCP 3268 and its TLS variant on TCP 3269.

3268
TCP

Port Details

Port
3268
Transport
TCP
Service
Global Catalog
IANA service name
msft-gc
Range
User port (1024-49151)
Related ports
3269389636

Security Exposure

The global catalog holds a partial replica of every naming context in the directory, so queries to 3268 can locate objects without knowing which domain holds them. Microsoft warns that unsigned LDAP traffic is susceptible to replay and man-in-the-middle attacks. Domain controller ports belong on internal networks only.

Hardening

  • +Block TCP 3268 and 3269 at the perimeter and allow them only from internal client and server networks.
  • +Prefer the TLS-protected global catalog port 3269 for applications that support it.
  • +Require LDAP signing on domain controllers so that unsigned binds and simple binds over non-TLS connections are rejected.
  • +Restrict which systems can query domain controllers from network segments that host untrusted or internet-facing workloads.

Monitoring

Watch for high volumes of LDAP queries to 3268 from hosts that do not normally query the global catalog. Event ID 2887 on domain controllers summarizes unsigned or cleartext LDAP binds, and enabling diagnostic logging adds per-client Event ID 2889 entries.

Tools for Auditing and Monitoring Global Catalog

BloodHound CE

Free / Commercial
Red Teaming Tools

Attack path analysis platform that maps identity and privilege relationships across Active Directory, Entra ID, and other platforms through OpenGraph.

LicenseApache-2.0
PlatformLinux, macOS, Windows

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Wazuh

Free / Commercial
SIEM Tools

Open-source SIEM and XDR platform providing endpoint monitoring, log analysis, file integrity checks, and threat detection.

LicenseGPL-2.0-only with OpenSSL linking exception
PlatformLinux, Windows, macOS, Solaris, AIX, HP-UX

Related Tool Categories

IAM Tools→

Secrets managers, identity engines, and access control platforms for managing credentials and privilege.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

What is the difference between ports 389 and 3268?→

Microsoft lists LDAP Server on TCP and UDP 389 and the Global Catalog on TCP 3268. The global catalog holds a partial replica of every naming context, which lets clients find objects across domains.

Is port 3268 TCP or UDP?→

Microsoft lists the Global Catalog on TCP 3268. IANA registers both transports for msft-gc.

Should port 3268 be reachable from the internet?→

No. It is a domain controller service that should only be reachable from internal networks.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 3268 is not guaranteed to be Global Catalog. Exploited-in-the-wild data from the CISA KEV catalog (CC0).