Port 9389: Active Directory Web Services
IANA registers TCP 9389 as adws (Active Directory Web Services), with UDP 9389 reserved. Active Directory Web Services runs on domain controllers and provides the web service interface used by the Active Directory module for Windows PowerShell and the Active Directory Administrative Center. Microsoft's port reference also lists 9389 for the older Active Directory Management Gateway Service.
Port Details
Security Exposure
Client applications such as the Active Directory module for Windows PowerShell and the Active Directory Administrative Center use ADWS to access and manage directory service instances on the server. ADWS is installed automatically with the AD DS and AD LDS roles, and domain controllers enable the "Active Directory Web Services (TCP-in)" firewall rule by default, so network-level filtering is what limits who can reach it.
Hardening
- +Block 9389 at the perimeter and between untrusted segments and domain controllers.
- +Allow 9389 to domain controllers only from administrative workstations and management servers that use the AD PowerShell module or ADAC.
- +Scope the default "Active Directory Web Services (TCP-in)" firewall rule to management subnets instead of any address.
- +Keep domain controllers on current Windows security updates.
Monitoring
Monitor connections to 9389 on domain controllers and alert on sources that are not administrative hosts.
Tools for Auditing and Monitoring ADWS
BloodHound CE
Free / CommercialAttack path analysis platform that maps identity and privilege relationships across Active Directory, Entra ID, and other platforms through OpenGraph.
Microsoft Defender for Endpoint
CommercialMicrosoft enterprise EDR covering Windows, macOS, Linux, and mobile from one console.
Nmap
Free / CommercialNetwork discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.
Related Tool Categories
Secrets managers, identity engines, and access control platforms for managing credentials and privilege.
Zero trust access, secure web gateways, firewalls, and perimeter enforcement platforms.
SIEM platforms, EDR agents, SOAR automation, and detection rule engines for security operations.
Frequently Asked Questions
What is port 9389?→
It is Active Directory Web Services on domain controllers. The AD PowerShell module and the Active Directory Administrative Center connect to it.
Does port 9389 need to be open?→
Only between domain controllers and the hosts that run AD management tools. Microsoft's troubleshooting guide checks that ADWS listens on 9389 and that the firewall allows it inbound.
Is port 9389 TCP or UDP?→
TCP. IANA lists UDP 9389 as reserved.
Sources
Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 9389 is not guaranteed to be ADWS. Exploited-in-the-wild data from the CISA KEV catalog (CC0).