|
|
|
|
Windows Server 2003 ports and firewalls Who is the intended audience?Technically competent Information Technology (IT) literate people that have a desire to protect their Windows Server 2003 servers from Local Area Network (LAN) based threats, through the use of locally installed personal firewalls running on their servers. What is this document for?It describes the protocols and ports necessary to enable a Windows Server 2003 to be firewalled, and yet provide normal service on the LAN. User/Computer login and authenticationThe following protocols and ports are required:
File accessThe following protocols and ports are required:
Establishing an explicit trust between Active Directory (AD) domainsThe following protocols and ports are required:
Validating and authenticating a trustThe following protocols and ports are required:
AD replication, mutual authentication and Domain Controller (DC) locationThe following protocols and ports are required:
Non-AD ports that are also requiredThe following protocols and ports are required:
How to force AD to use a static portAD, by default, uses a dynamic port which is determined by a call to the RPC endpoint mapper. AD can be set to a fixed address and, indeed, must be in order to firewall the server. This fixed port is still determined by a call to the RPC port mapper, but will always be the same.To set AD to use a static TCP port, set the following registry key and then restart the server:
In this example, the port is set to a hexadecimal value of 0xC000 which is a decimal value of 49152 (12x4096). You might care to read the original Microsoft article for further details. How to force AD replication to use a static portFor Windows 2000 Server, post SP2, the File Replication Service (FRS), by default, uses a dynamic port which is determined by a call to the RPC endpoint mapper. FRS can be set to a fixed address and, indeed, must be in order to firewall the server. This fixed port is still determined by a call to the RPC port mapper, but will always be the same.To set FRS to use a static TCP port, set the following registry key and then restart the server:
In this example, the port is set to a hexadecimal value of 0xC001 which is a decimal value of 49153 (12x4096+1). You might care to read the original Microsoft article for further details. Limiting the range of dynamic RPC portsThe dynamic ports can be restricted to a smaller range and Microsoft recommend that there are at least 20 ports in the range and that they are not below 5000.To limit the range of dynamic RPC ports, add the following registry key and then restart the server:
In this example, the ports are set to use 20 ports in the range 5000 through 5019. You might care to read the original Microsoft article for further details. |
|
Jarmanator IT Ltd is a private limited company registered in
England with the registration number 05079569 and whose registered offices are 3
Warners Mill, Silks Way, BRAINTREE, CM7 3GB
|