Port 3268 – LDAP Global Catalog

TCP

Port 3268 is the Active Directory Global Catalog LDAP port. The Global Catalog contains a partial, read-only replica of all objects across all domains in an AD forest. Applications query port 3268 for cross-domain lookups – finding a user's group membership across domain boundaries. Use port 3269 for the encrypted (TLS) equivalent.

Port Number

3268

Protocol

TCP

Service

Active Directory Global Catalog

Range

IANA Registered (1024–49151)

Description

Active Directory Global Catalog on port 3268 serves a subset of attributes from every object in every domain within the forest. When an application needs to find a user or group that might exist in any domain, it queries port 3268 instead of guessing which domain controller to ask. Exchange Server relies heavily on the Global Catalog for address book lookups and recipient resolution. Universal group membership is only resolvable via the Global Catalog. If port 3268 is unavailable, cross-domain authentication fails and Exchange cannot resolve recipients. Every AD site with users or applications should have a local Global Catalog server to avoid WAN dependency.

Security risks

1Cross-domain enumeration: Global Catalog on 3268 contains a partial replica of ALL objects in the entire AD forest – a single query reveals users, groups, and computers across all domains
2Universal group membership exposure: port 3268 is queried for universal group memberships during Kerberos ticket generation – compromising GC access reveals all security group hierarchies
3Exchange dependency: Microsoft Exchange requires Global Catalog access. If 3268 is unavailable, email delivery fails. Attackers target GC availability for denial-of-service against email
4No authentication difference from port 389: same anonymous bind risks apply – if anonymous LDAP is enabled on 389, it's also enabled on 3268
5Forest-wide scope: unlike port 389 (domain-scoped), port 3268 returns objects from the entire forest. A compromised single-domain account can enumerate the entire organization

Firewall guidance

Port 3268 must be accessible from: all domain-joined machines (Kerberos universal group resolution), Exchange servers, and applications performing forest-wide lookups. Restrict to internal networks only – never internet-facing. Use port 3269 (GC over SSL) for sensitive queries. In multi-site AD: 3268 must be available in every site (deploy a GC in each site to avoid WAN dependency).

Diagnosis commands

Count all user objects across the forest (GC scope)

shell

ldapsearch -H ldap://dc:3268 -x -b 'dc=example,dc=com' '(objectClass=user)' cn | wc -l

Windows: locate Global Catalog servers for the domain

shell

nltest /dsgetdc:example.com /gc

DNS lookup for Global Catalog SRV records

shell

nslookup -type=srv _gc._tcp.example.com

Check GC replication status between domain controllers

shell

repadmin /showrepl dc /verbose | grep 'GC'

Usage examples

Port 3268 – LDAP Global Catalog

shell

ldapsearch -H ldap://gc:3268 -b 'dc=forest,dc=com' '([email protected])'
nltest /dsgetdc:forest.com /GC
Get-ADDomainController -Filter {IsGlobalCatalog -eq $true}

Common services on this port

Active Directory Domain Services (Global Catalog role)Azure AD ConnectMicrosoft Exchange Server

Related ports

3268

Global Catalog LDAP (this port)

3269

Global Catalog LDAPS (TLS)

389

LDAP (domain-scoped)

636

LDAPS (domain-scoped, TLS)

History

The Global Catalog was introduced with Active Directory in Windows 2000. Port 3268 was assigned for LDAP access to the GC (a read-only partial replica of all objects in the AD forest). It was designed to support multi-domain forests where clients need cross-domain lookups without knowing which domain holds an object. Exchange Server's dependence on GC makes port 3268 critical infrastructure in most enterprises.

FAQ

Why does Exchange need the Global Catalog?

Exchange queries port 3268 to: (1) resolve email addresses to AD objects across domains, (2) expand distribution groups that span multiple domains, (3) evaluate address book policies, and (4) process transport rules that reference AD attributes. If GC is unavailable, Exchange queues messages and mail flow stops. Microsoft recommends a GC server in every AD site that has Exchange servers.

Port 3268 vs 389 – when should applications use GC?

Use port 3268 (GC) when: querying across multiple domains in a forest, resolving UPN logins ([email protected] format), or needing universal group membership. Use port 389 when: querying within a single domain, needing full attribute set (GC only stores a subset), or performing write operations (GC is read-only). Applications that authenticate users by UPN should use 3268 to find the user regardless of their home domain.

Specification

RFC 4511 – Port 3268 specification →