Active Directory e le porte di rete necessarie al funzionamento dei servizi di dominio

In taluni scenari scenari può essere necessario frapporre un firewall tra i Domain Controller e i client di Active Directory oppure tra i Domain Controller e i ReadOnly Domain Controller.

In questi casi occorre configurare opportunamente il firewall per consentire tutto il traffico necessario senza però esporre i Domain Controller su porte di rete non necessarie.

Per trovare informazioni su quali siano le porte di rete utilizzate è possibile fare rifermento al seguente Active Directory and Active Directory Domain Services Port Requirements | Microsoft Learn. Di seguito una tabella che indica le porte di rete necessarie per la comunicazione tra client Active Directory e Domain Controller.

Nel caso in cui siano state definite policy che utilizzano file memorizzati su share su server i client dovranno poter comunicare verso questi server sulle porte TCP/UDP 445.

Per quanto riguarda le porte destinate alla comunicazione RCP dinamica, ovvero le porte TCP e UDP 49152 – 65535 (dette anche porte effimere), utilizzate per gestire le RPC in Active Directory è possibile specificare una porta specifica attraverso cui gestire tutto il traffico RPC di Active Directory, ovveri sia il traffico di replica di Active Directory che il traffico client.

Per limitare limitare il traffico RPC di Active Directory a una porta specifica occorre modificare sui Domain Controller il registro si sistema perché Active Directory e il servizio Netlogon utilizzino una porta specifica come indicato in Restrict Active Directory RPC traffic to a specific port – Windows Server | Microsoft Learn:

Use Registry Editor to modify the following values on each domain controller where the restricted ports are to be used. Member servers aren’t considered to be logon servers. So static port assignment for NTDS has no effect on member servers.

Member servers do have the Netlogon RPC Interface, but it’s rarely used. Some examples may be remote configuration retrieval, such as nltest /server:member.contoso.com /sc_query:contoso.com.

Registry key 1
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTDS\Parameters
Registry value: TCP/IP Port
Value type: REG_DWORD
Value data: (available port)

Restart the computer for the new setting to become effective.

Registry key 2
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters
Registry value: DCTcpipPort
Value type: REG_DWORD
Value data: (available port)

Restart the Netlogon service for the new setting to become effective.

When you use the DCTcpipPort registry entry, and you set it to the same port as the TCP/IP Port registry entry, you receive Netlogon error event 5809 under NTDS\Parameters. This indicates that the port configured is in use, and you should choose a different port.

You’ll receive the same event when you have a unique port, and you restart the Netlogon service on the domain controller. This behavior is by design. It occurs because of the way the RPC runtime manages its server ports. The port will be used after the restart, and the event can be ignored.

Administrators should confirm that the communication over the specified port is enabled if any intermediate network devices or software is used to filter packets between the domain controllers.

Frequently, you must also manually set the File Replication Service (FRS) RPC port because AD and FRS replication replicate with the same Domain Controllers. The FRS RPC port should use a different port.

Don’t assume that clients only use the Netlogon RPC services and thus only the setting DCTcpipPort is required. Clients are also using other RPC services such as SamRPC, LSARPC, and also the Directory Replication Services (DRS) interface. You should always configure both registry settings and open both ports on the firewall.

Come indicato specificare due porte differenti per Active Directory e per il servizio Netlogon, inoltre va specificata una porta diversa per il File Replication Service (FRS) RPC e quindi anche per il DFS-R.

Per impostare una porta di rete statica specifica per FRS anziché utilizzare una porta dinamica è possibile impostare la chiave di registro REG_DWORD “RPC TCP/IP Port Assignment” in HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NTFRS\Parameters. A riguardo si veda la copia della KB319553 How to restrict FRS replication traffic to a specific static port ancora disponile nel sito non ufficiale https://mskb.pkisolutions.com/ che mantiene copia delle KB Microsoft non più disponibili.

Mentre per impostare una porta di rete statica specifica per DFS-R anziché utilizzare una porta dinamica è possibile impostare la chiave di registro REG_DWORD “RPC TCP/IP Port Assignment” in HKEY_LOCAL_MACHINE\Software\Microsoft\DFS\GlobalSettings\Parameters o in alternativa usare il comando DFSRDIAG STATICRPC come indicato in Configuring DFSR to a Static Port – The rest of the story – Microsoft Community Hub,

Per ulteriori approfondimenti si vedano:

• Active Directory and Active Directory Domain Services Port Requirements | Microsoft Learn
• Restrict Active Directory RPC traffic to a specific port – Windows Server | Microsoft Learn
• The default dynamic port range for TCP/IP has changed in Windows Vista and in Windows Server 2008 – Windows Server | Microsoft Learn
• Various network and computer issues occur when TCP ephemeral ports are exhausted in Windows 8 or Windows Server 2012 – Microsoft Support
• Reliability and scalability improvements in TCP/IP for Windows 8.1 and Windows Server 2012 R2 – Microsoft Support
• Designing RODCs in the Perimeter Network | Microsoft Learn
• Configure firewall for AD domain and trusts – Windows Server | Microsoft Learn
• Service overview and network port requirements – Windows Server | Microsoft Learn