Skip to main content
protocols.pageprotocols.page
464

Port 464 – Kerberos Password Change

TCP/UDP

Port 464 is the Kerberos password change (kpasswd) port used by Active Directory and MIT Kerberos for password resets. Users authenticate with their current credentials on port 464 to set new passwords. This port must be accessible between domain controllers and all domain-joined clients.

Port Number

464

Protocol

TCP/UDP

Service

Kerberos kpasswd

Range

IANA Well-Known (0–1023)

Description

The Kerberos password change protocol on port 464 handles user-initiated password changes and administrator-initiated password resets in Active Directory environments. The client presents a valid Kerberos ticket and new password to the kpasswd service. Port 464 is required for domain-joined machines to process password changes. If port 464 is blocked between a client and its domain controller, password change operations fail silently or with cryptic Kerberos errors. In multi-site Active Directory deployments, port 464 must be open between all DC sites.

Security risks

  • 1CVE-2022-33647: Windows Kerberos elevation of privilege via kpasswd – allows attacker to modify service tickets during password change operation (CVSS 8.1)
  • 2Password spray visibility: kpasswd port 464 is used for password changes – monitoring connection attempts reveals password spray campaigns targeting AD accounts
  • 3Kerberos pre-authentication bypass: if pre-auth is disabled for accounts (AS-REP roasting), attackers can request password change tickets without valid credentials
  • 4Plaintext password in transit: kpasswd protocol transmits the new password encrypted under the session key, but if KDC ↔ client communication is intercepted pre-auth, the password can be recovered
  • 5DC availability: blocking port 464 between clients and DCs prevents all password changes, causing helpdesk floods and security lockout when expired passwords can't be reset

Firewall guidance

Port 464 must be open from all domain-joined clients to all domain controllers. In multi-site AD, it must be open between sites (via site links). Cannot be blocked without breaking password changes. Ensure it's only reachable from internal networks – never internet-facing. If using Azure AD Password Protection, port 464 remains required for on-premises changes.

Diagnosis commands

Test password change via Kerberos (should prompt for old and new password)

shell
kpasswd username@REALM

Verify kpasswd port is reachable on domain controller

shell
nmap -p 464 dc1.example.com

Windows DC: verify kpasswd service is listening

shell
netstat -an | findstr 464

Linux: verify kpasswd service principal exists in keytab

shell
klist -k /etc/krb5.keytab | grep kadmin

Usage examples

Port 464 – Kerberos Password Change
shell
kpasswd user@REALM
kadmin.local: cpw user
Set-ADAccountPassword -Identity user

Common services on this port

Active Directory Domain ControllersMIT Kerberos KDCFreeIPAHeimdal Kerberos

Related ports

88

Kerberos KDC (authentication)

464

kpasswd (this port)

389

LDAP (AD directory queries)

636

LDAPS (secure AD queries)

History

Kerberos password change protocol (kpasswd) was defined in RFC 3244 (2002) as an extension to Kerberos V5. Port 464 was assigned for both TCP and UDP. In Active Directory, the KDC (Key Distribution Center) on every domain controller listens on both port 88 (authentication) and 464 (password changes). The protocol allows users to change their own passwords and admins to reset others' passwords, all authenticated via Kerberos tickets.

FAQ

Why can't my users change their passwords?

Check: (1) Port 464 open from client to DC (Test-NetConnection dc -Port 464), (2) Password policy allows change (net accounts shows minimum password age), (3) User account not locked or disabled, (4) New password meets complexity requirements. Common in VPN scenarios: split-tunnel VPN may not route port 464 to the DC subnet. Fix: include DC subnet in VPN routes or use Azure AD SSPR.

Is port 464 required if I use Azure AD?

For hybrid environments (Azure AD Connect): yes, port 464 is still needed for on-premises password changes and password writeback from Azure AD. For cloud-only Azure AD (Entra ID) with no on-premises DCs: port 464 is not needed – password changes go through the Microsoft identity platform APIs. If you have Azure AD Password Protection on-premises, port 464 must be open between the proxy service and DCs.

Specification

RFC 3244 – Port 464 specification →