whatportis.com
suggest an edit →

Port 3268Microsoft Global Catalog (GC)

Port 3268 is primarily used by Microsoft Domain Controllers to provide access to the Global Catalog service. This service allows fast searches across an entire Active Directory forest using LDAP. It contains a partial, read-only replica of all objects in the directory, facilitating user logins, address book lookups, and efficient query capabilities in large, multi-domain environments..

inSecurityNetwork ServicesSystem
transport
tcp · udp

2 transports registered

in transit
cleartext

payload readable on path

assignment
official

registered with iana

risk
5/10

caution

lookups
54,638

rank 19 of 993 · top 2%

Technical Details

what runs on :3268

Microsoft Global Catalog on port 3268 is an LDAP service designed to facilitate directory searches across an entire Active Directory forest. The Global Catalog holds a partial replica of all objects within AD domains, containing the most commonly searched attributes, such as usernames and email addresses. This allows clients to perform queries without knowing the domain location of an object, improving query efficiency.

The Global Catalog service runs on Domain Controllers designated as Global Catalog servers and is integral to AD operations. It is especially vital during user logon processes in multi-domain forests, assisting the authentication mechanism by resolving Universal Principal Names (UPNs) and membership in Universal security groups. Applications relying on directory services, such as Microsoft Exchange, utilize the Global Catalog extensively for recipient resolution and directory lookups.

Queries to the Global Catalog occur via LDAP over port 3268 for standard queries and via 3269 when using secured (SSL/TLS-encrypted) LDAP. The service does not provide write capabilities—modifications must be performed against the appropriate domain controller through standard LDAP ports, typically 389/636.

Security Information

exposure of :3268

risk score

5/ 10caution

worth attention. how exposed you are depends on configuration — don't leave it reachable from the internet without a reason.

security averages 3.8 across 216 ports — this one sits 1.2 above.

in transit

cleartext

credentials and payloads are readable by anyone on path

assignment

official

registered with iana for this service — scanners fingerprint it by number

reachable over

tcp · udp

udp is connectionless — source addresses are trivially spoofed and it is a reflection favourite

security overview

Common Vulnerabilities:

  • Enumeration Attacks: Open access may allow attackers to enumerate user accounts, groups, and other directory metadata, aiding in lateral movement or social engineering.
  • Data Exposure: Since data is often unencrypted by default on this port, sensitive details such as email addresses or group memberships could be intercepted via packet sniffing.
  • Brute-force & Credential Attacks: If connected to authentication services, the port could be targeted for brute-force attacks or other login-based abuse.

Common Mitigations:

  • Restrict Access: Limit access to trusted network segments and authorized users/devices only, using firewalls and segmentation.
  • Encrypt LDAP Traffic: Enforce the use of LDAPS (port 3269) to protect confidentiality of transmitted information.
  • Monitor & Log: Enable detailed logging and alerting on suspicious LDAP queries or authentication failures.
  • Harden Global Catalog Servers: Implement AD security best practices including patch management, secure configurations, and least privilege principles.

Related Ports

all 216 in security →

the 8 most looked-up other ports in security — 216 ports carry that label.

portservicerisk
:8881Atlasz Secure Servercaution
:443HTTPScaution
:8291Winbox MikroTik Admincaution
:135Microsoft EPMAPcaution
:3128Squid Proxy HTTPcaution
:8080HTTP Alternatecaution
:7000Vuze HTTPS Trackercaution
:981Check Point Embedded HTTPS Managementcaution

risk mix of the 8 listed

  • caution100%

4 of 8 encrypted