How to secure your Active Directory from attackers from outside world
Of course. You are looking at a standard Nmap
scan of a Windows
Domain Controller. Blocking these ports will severely break or completely
disable your Active
Directory domain and related services. Clients will be unable to log
in, access files, or use domain
resources.
Warning: Do not block these ports on a Domain Controller
without a deep understanding of the consequences. These are not "default
ports to be blocked"; they are core service ports required for the server
to function.
A more secure approach is to control access to these ports
rather than blocking them entirely.
Here is a breakdown of what each service does and the
correct way to secure it.
---
Understanding the
Ports & The Secure Alternative to Blocking
Instead of blocking, you should implement Windows
Firewall with Advanced Security to restrict which source IPs are allowed to
connect to these services.
| Port | Service | Purpose | Consequence of Blocking |
Recommended Security Action |
| :--- | :--- | :--- | :--- | :--- |
| 53
| DNS | Name
resolution for the entire domain. | Clients and servers cannot find each
other. Domain breaks. | Restrict DNS queries to only your internal network
subnets. |
| 88 | Kerberos | Authentication
for the entire domain. | No one can log in. | Restrict to your
domain-joined clients and servers. |
| 135
| MSRPC | Remote
Procedure Call. Used by many management tools. | Breaks management tools
and inter-service communication. | Hard to restrict, but can be limited to
specific server IPs. |
| 139/445
| NetBIOS/SMB | File
and printer sharing, network logon. | Clients cannot access shared drives
or group policy. | Ensure SMB signing is enforced. Restrict to domain networks.
|
| 389/636
| LDAP/LDAPS | Directory
services queries (e.g., user/group lookups). | Applications and users
cannot query AD. Logins fail. | Enforce LDAP signing/channel binding. Restrict
client IP ranges. |
| 3268/3269
| Global
Catalog | LDAP for forest-wide searches (e.g., Universal Groups). |
Multi-domain logins and searches fail. | Same as LDAP. Restrict access. |
| 464
| kpasswd | Kerberos
password change. | Users cannot change their passwords. | Restrict to
domain networks. |
| 593
| RPC
over HTTP | Remote procedure calls over HTTP. | May break specific
distributed applications. | Usually required by specific apps. Restrict if not
needed. |
| 3389
| RDP | Remote
Desktop. | You cannot administer the server remotely. | This is a critical
one to secure. Use a VPN or restrict RDP to a dedicated "jump box" or
specific admin IPs. |
| 5985
| WinRM | Windows
Remote Management (PowerShell remoting). | Breaks PowerShell-based
management and automation. | Use it over HTTPS (5986) instead, and restrict
source IPs. |
---
How to Implement the
Secure Approach: Restricting Access with Windows Firewall
The correct method is to create Inbound
Firewall Rules that allow traffic only from authorized subnets.
Step-by-Step Guide:
1. Open Windows Firewall with Advanced Security (``wf.msc``).
2. For each port, you will create a custom rule. Let's
use LDAP (Port 389) as an example.
* Click on Inbound Rules -> New
Rule...
* Rule Type: Select Port ->
Click Next.
* Protocol and Ports: Select TCP
and enter Specific local ports: `389` -> Click Next.
* Action: Select Allow the
connection -> Click Next.
* Profile: Select all that apply
(Domain, Private, Public) or just "Domain" for maximum security ->
Click Next.
* Name: Give it a clear name,
e.g., "LDAP (389) - Restricted to Internal Network".
3. The Most Important Step - Scope the Rule:
·
After creating the rule, find it in the Inbound
Rules list and double-click to open its properties.
·
Go to the Scope tab.
·
Under Remote IP address, select These IP
addresses:.
·
Click Add... and enter the IP ranges of your
internal corporate network (e.g., `192.168.1.0/24`).
·
Click OK.
[](https://i.imgur.com/2XpB3eh.png)
4. Repeat this process for other critical services
like RDP (3389), Kerberos (88), and WinRM (5985). For services like RDP, it is
highly recommended to restrict the scope to a very small set of administrative
workstations or a VPN subnet.
Summary: What You Should Do
1. DO NOT BLOCK these ports outright. Your domain will
stop working.
2. DO SECURE them by creating firewall allow rules
that are scoped to your specific internal IP ranges.
3. PRIORITIZE securing RDP (3389) and WinRM (5985)
first, as these are common attack vectors for remote access.
4. Consider placing critical servers like Domain
Controllers on a protected "server
VLAN" with its own firewall rules, isolating them from general user
traffic.
By following this method, you maintain the functionality of
your essential services while significantly reducing your attack
surface.
Comments
Post a Comment