Port 464: Kerberos Change/Set Password protocol
Port 464 carries the Kerberos password change and set password protocol. RFC 3244 documents the Windows 2000 version, which accepts requests on both UDP 464 and TCP 464. On Windows, the Kerberos Key Distribution Center service on domain controllers listens on this port.
Port Details
Security Exposure
A listener on 464 indicates a Kerberos password change service; Microsoft lists it under the Kerberos Key Distribution Center on domain controllers. Because the service accepts password change and set password requests (RFC 3244), it belongs only on networks where domain clients sit.
Hardening
- +Allow 464 only from internal client and server networks; never publish it at the internet edge.
- +Keep domain controllers on restricted network segments with tightly scoped firewall rules.
- +Enforce strong password policy and account lockout so password-change abuse is limited.
- +Keep domain controllers patched with current Windows security updates.
Monitoring
Collect Windows Security events 4723 (attempt to change an account's password) and 4724 (attempt to reset a password) from domain controllers. Investigate bursts of failures or changes to privileged accounts.
Tools for Auditing and Monitoring Kerberos kpasswd
BloodHound CE
Free / CommercialAttack path analysis platform that maps identity and privilege relationships across Active Directory, Entra ID, and other platforms through OpenGraph.
Nmap
Free / CommercialNetwork discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.
Zeek
Open SourceNetwork security monitoring framework that translates raw packet traffic into structured transaction logs and network events.
Related Tool Categories
Secrets managers, identity engines, and access control platforms for managing credentials and privilege.
Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.
SIEM platforms, EDR agents, SOAR automation, and detection rule engines for security operations.
Frequently Asked Questions
What is port 464 used for?→
It carries the Kerberos password change protocol (kpasswd). Microsoft lists it as Kerberos Password V5 on TCP and UDP 464 for the Kerberos Key Distribution Center.
Is port 464 TCP or UDP?→
Both. RFC 3244 says the service accepts requests on UDP port 464 and TCP port 464.
Sources
- IANA Service Name and Port Number Registry: port 464
- RFC 3244: Microsoft Windows 2000 Kerberos Change Password and Set Password Protocols
- Microsoft Learn: Service overview and network port requirements for Windows
- Microsoft Learn: 4723(S, F) An attempt was made to change an account's password
- Microsoft Learn: 4724(S, F) An attempt was made to reset an account's password
Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 464 is not guaranteed to be Kerberos kpasswd. Exploited-in-the-wild data from the CISA KEV catalog (CC0).