What uses port 3268
The Global Catalog holds a partial copy of every object in an Active Directory forest, so applications can find users from any domain with a single query. It speaks LDAP on 3268 and LDAP over TLS on 3269. Applications that only see users of one domain may need to point at the Global Catalog instead of port 389.
Should port 3268 be open to the internet?
Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.
Check what is listening on port 3268
sudo ss -ltnp 'sport = :3268'sudo lsof -nP -iTCP:3268 -sTCP:LISTENGet-NetTCPConnection -LocalPort 3268 -State Listen
netstat -ano | findstr :3268No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.
Fix “address already in use” on port 3268
Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:
sudo kill $(sudo lsof -t -iTCP:3268 -sTCP:LISTEN)Stop-Process -Id (Get-NetTCPConnection -LocalPort 3268 -State Listen).OwningProcessAllow port 3268 from trusted networks only
The examples allow 3268 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.
sudo ufw allow from 10.0.0.0/8 to any port 3268 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 3268 proto tcpsudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="3268" protocol="tcp" accept'
sudo firewall-cmd --reloadNew-NetFirewallRule -DisplayName "Active Directory Global Catalog 3268/TCP" -Direction Inbound -Protocol TCP -LocalPort 3268 -Action Allow -RemoteAddress 10.0.0.0/8On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.
Test port 3268 from another machine
nc -zv example.com 3268Test-NetConnection example.com -Port 3268Related ports
- Port 389 (LDAP): used by LDAP for directory lookups and authentication, including Active Directory.
- Port 3269 (Global Catalog over TLS): used by the Active Directory Global Catalog over TLS.
- Port 636 (LDAPS): used by LDAP over TLS (LDAPS) for encrypted directory access.
More network services ports
53 (DNS) , 67 (DHCP server) , 68 (DHCP client) , 88 (Kerberos) , 123 (NTP) , 135 (Microsoft RPC) , 137 (NetBIOS Name Service) , 179 (BGP) . See all ports in the port lookup.
Sources
Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.
Frequently asked questions
What is port 3268 used for?
Port 3268 is used by the Active Directory Global Catalog for forest-wide LDAP searches. The Global Catalog holds a partial copy of every object in an Active Directory forest, so applications can find users from any domain with a single query. It speaks LDAP on 3268 and LDAP over TLS on 3269. Applications that only see users of one domain may need to point at the Global Catalog instead of port 389.
Is it safe to open port 3268?
Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel. Allow it only from the networks that need it, as in the firewall examples on this page.
How do I check if port 3268 is open?
On the server, list listening sockets with "sudo ss -ltnp 'sport = :3268'" on Linux or "sudo lsof -nP -i :3268" on macOS. From another machine, run "nc -zv host 3268" or, on Windows, "Test-NetConnection host -Port 3268". Connection refused means nothing is listening; a timeout means a firewall is dropping the traffic.