Port 3269 – LDAP Global Catalog SSL

TCP

Port 3269 is the TLS-encrypted Active Directory Global Catalog port – the secure equivalent of port 3268. Applications performing cross-domain LDAP queries over untrusted networks should use port 3269 to prevent credential interception. Requires a valid certificate on the domain controller.

Port Number

3269

Protocol

TCP

Service

Active Directory Global Catalog (SSL)

Range

IANA Registered (1024–49151)

Description

Global Catalog over TLS on port 3269 encrypts all LDAP queries and responses to the AD forest-wide catalog. This is the secure version of port 3268, providing implicit TLS from connection start – identical to the relationship between ports 389 (LDAP) and 636 (LDAPS). Use port 3269 when Global Catalog queries traverse untrusted network segments or when compliance requires encryption of directory data in transit. The domain controller needs a certificate with the Server Authentication EKU – typically provisioned by the domain's Enterprise CA via auto-enrollment. Applications connecting to port 3269 must trust the issuing CA.

Security risks

1Same forest-wide enumeration risks as port 3268, but encrypted in transit – TLS protects against eavesdropping but not against authorized over-querying
2Certificate management: if the DC's certificate expires, port 3269 stops working while 3268 continues – applications may silently fall back to unencrypted 3268
3Weak TLS configurations: older DCs may offer TLS 1.0 on port 3269, which is vulnerable to BEAST and other downgrade attacks
4Azure AD Connect sync over 3269: misconfigured sync accounts with broad read access on GC can exfiltrate the entire directory to Azure (legitimate but overprivileged)

Firewall guidance

Same access rules as port 3268 – restrict to domain-joined machines and Exchange servers. Prefer 3269 over 3268 for all GC queries to ensure encryption. Verify DC certificates are auto-renewed (Enterprise CA auto-enrollment). Monitor for fallback to 3268 in application logs.

Diagnosis commands

Check GC SSL certificate expiry

shell

openssl s_client -connect dc:3269 -showcerts 2>/dev/null | openssl x509 -noout -dates

Test LDAPS GC connectivity and supported extensions

shell

ldapsearch -H ldaps://dc:3269 -x -b '' -s base supportedControl

Verify TLS version (should be 1.2 or 1.3)

shell

echo | openssl s_client -connect dc:3269 2>/dev/null | grep Protocol

Usage examples

Port 3269 – LDAP Global Catalog SSL

shell

ldapsearch -H ldaps://gc:3269 -b 'dc=forest,dc=com' '(sAMAccountName=user)'
openssl s_client -connect dc:3269
LDAPTLS_REQCERT=allow ldapsearch -H ldaps://gc:3269

Common services on this port

Active Directory Global Catalog (TLS)Azure AD ConnectExchange Server (secure GC queries)

Related ports

3269

Global Catalog LDAPS (this port)

3268

Global Catalog LDAP (unencrypted)

636

LDAPS (domain-scoped)

History

Port 3269 was assigned alongside port 3268 when Active Directory was released with Windows 2000. It provides the same Global Catalog functionality as 3268 but over implicit TLS (same relationship as LDAP/389 vs LDAPS/636). Microsoft's push toward encrypted LDAP (channel binding requirements in newer Windows Server versions) makes port 3269 increasingly the required path for GC queries.

FAQ

Should I always use 3269 instead of 3268?

Yes, when possible. Port 3269 encrypts the entire GC query and response. The only valid reason for 3268: legacy applications that don't support LDAPS, or environments without certificate infrastructure (no CA to issue DC certificates). Microsoft's roadmap requires LDAP signing/encryption, so applications still using 3268 will eventually break when Microsoft enforces the policy.