Skip to main content
IMMUNITYSEC

Port 3269: Active Directory Global Catalog with LDAP over SSL/TLS

TCP 3269 is the TLS-protected counterpart of the Active Directory global catalog port 3268. IANA registers it as msft-gc-ssl (Microsoft Global Catalog with LDAP/SSL). Microsoft lists Global Catalog on TCP 3269 alongside 3268, LDAP 389 and LDAP SSL 636.

3269
TCP

Port Details

Port
3269
Transport
TCP
Service
Global Catalog over TLS
IANA service name
msft-gc-ssl
Range
User port (1024-49151)
Related ports
3268636389

Security Exposure

TLS protects global catalog queries in transit, but the service still answers searches across a partial replica of every naming context in the forest. A reachable 3269 port on an internet-facing domain controller exposes that directory to credential guessing and enumeration. Domain controller services are intended for internal clients only.

Hardening

  • +Allow TCP 3269 only from internal networks and block it at the perimeter.
  • +Keep domain controller certificates valid and trusted by clients so that TLS connections to 3269 succeed.
  • +Move applications that query the global catalog from 3268 to 3269 where they support TLS.
  • +Require LDAP signing on domain controllers so that clients still using plaintext ports cannot bind without integrity protection.

Monitoring

Track which hosts connect to 3269 and alert on unexpected sources. Event ID 2887 on domain controllers shows whether clients still perform unsigned or cleartext binds that should move to TLS.

Tools for Auditing and Monitoring Global Catalog over TLS

BloodHound CE

Free / Commercial
Red Teaming Tools

Attack path analysis platform that maps identity and privilege relationships across Active Directory, Entra ID, and other platforms through OpenGraph.

LicenseApache-2.0
PlatformLinux, macOS, Windows

Zeek

Open Source
Network Monitoring Tools

Network security monitoring framework that translates raw packet traffic into structured transaction logs and network events.

LicenseBSD-3-Clause
PlatformLinux, FreeBSD, macOS, OpenBSD

Nmap

Free / Commercial
Penetration Testing Tools

Network discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.

LicenseNPSL-0.95 (Nmap Public Source License, not OSI-approved)
PlatformLinux, macOS, Windows

Related Tool Categories

IAM Tools→

Secrets managers, identity engines, and access control platforms for managing credentials and privilege.

Network Security Tools→

Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.

Frequently Asked Questions

What is port 3269 used for?→

Port 3269 serves the Active Directory global catalog over LDAP with SSL/TLS. IANA registers it as msft-gc-ssl.

What is the difference between ports 3268 and 3269?→

Both serve the global catalog. IANA describes 3268 as Microsoft Global Catalog and 3269 as Global Catalog with LDAP/SSL, similar to how LDAP SSL on 636 relates to LDAP on 389.

Is port 3269 TCP or UDP?→

Microsoft lists the Global Catalog on TCP 3269. IANA registers both transports for msft-gc-ssl.

Sources

Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 3269 is not guaranteed to be Global Catalog over TLS. Exploited-in-the-wild data from the CISA KEV catalog (CC0).