Port 389LDAP

What port 389 is used for

LDAP is how applications read and search a directory: user accounts, groups, computers, certificates, address books. Active Directory exposes its database over LDAP on port 389, and so do most other directory servers. Clients on this port include:

• Windows itself, for locating domain controllers and reading policy.
• Applications that authenticate users "against AD" by binding with the user's credentials.
• Mail systems, VPN appliances, wikis and web apps that look up group membership.
• Administration tools such as ADSI Edit and ldp.exe.

Encryption options

Since 2020 Microsoft has pushed domain controllers toward requiring signing and channel binding, so unsigned simple binds on 389 increasingly fail against hardened environments.

Security considerations

• Never expose 389 to the internet. Domain controllers reachable on 389 leak account names and structure and are targets for password spraying.
• Prefer LDAPS or SASL binds. Configure applications for port 636 with certificate validation, or Kerberos binds where supported.
• Use a least-privilege service account for application lookups rather than an administrator.
• CLDAP on UDP 389 is an amplification vector when exposed publicly; another reason the port stays internal.

How to check port 389

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :389

A line in the LISTENING state means a local program has bound port 389; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :389 or lsof -i :389.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection dc01.corp.example -Port 389

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 389. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Find your domain controllers through DNS before testing the port:

nslookup -type=SRV _ldap._tcp.dc._msdcs.corp.example

Firewall considerations

Domain controllers need inbound TCP and UDP 389 from every client and member server in the domain. Member servers and workstations need no inbound 389. At the internet edge, block it in both directions.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 389 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.