Well, initially, ignore the Win2K3 server. Think of the ports you need to
allow as catering to the functionality of the workstations, not the server.
In that case, you probably want internet access, so allow ports 80(HTTP) and
443(SHTTP). Other than that, it's based upon the needs of your network...
if you run a mail server (Exchange, sendmail, etc.), you want to open ports
25(SMTP) and 110(POP3). It just depends on what your network needs from the
outside... ideally, your server (running AD) should not be serving anything
to the outside world, so the firewall wouldn't care about it. Thus, no
"fine-tuning" for AD.

If you want your DC to connect to DCs in remote locations, then you want to
look at VPN solutions for connecting the locations. Most likely, you want
to set up site-to-site VPNs between the locations; hopefully, your firewall
has the ability to set those up.

Hope that helps some.

-- N/A

-----Original Message-----
From: listbounce (at) securityfocus (dot) com [email concealed] [mailto:listbounce (at) securityfocus (dot) com [email concealed]] On
Behalf Of dubaisans dubai
Sent: Friday, July 20, 2007 1:24 AM
To: focus-ms (at) securityfocus (dot) com [email concealed]
Subject: win2k3 active directory - firewall ports

i want to put win2k3 active directory server behind the corporate
firewall. we are using windows xp clients and also group policy

what ports need to be allowed on firewall ? is there any fine tuning
that can be done on AD to make it more firewall friendly?

i have some DC is remote locations . what ports need to be allowed between
DCs?

[ reply ]