By default, Active Directory replication remote procedure calls (RPC) occur dynamically over an available port through the RPC Endpoint Mapper (RPCSS) by using port 135. This process is the same process as in Microsoft Exchange. As in Microsoft Exchange, an administrator can override this functionality and specify the port that all Active Directory RPC traffic passes through. This procedure locks the port down.
When you specify ports to use by using the registry entries that are mentioned in the "More Information" section, both Active Directory server-side replication traffic and client RPC traffic are sent to these ports by the endpoint mapper. This configuration is possible because all RPC interfaces that are supported by Active Directory are running on all ports on which it is listening. Note
This article does not imply that replication can occur through a firewall. Additional ports must be opened to make replication work through a firewall. For example, additional ports must be opened for the Kerberos protocol. To obtain a complete list of the required ports for services across a firewall, click the following article number to view the article in the Microsoft Knowledge Base:
Service overview and network port requirements for the Windows Server system
This section, method, or task contains steps that tell you how to modify the registry. However, serious problems might occur if you modify the registry incorrectly. Therefore, make sure that you follow these steps carefully. For added protection, back up the registry before you modify it. Then, you can restore the registry if a problem occurs. For more information about how to back up and restore the registry, click the following article number to view the article in the Microsoft Knowledge Base:
How to back up and restore the registry in Windows
When you connect to an RPC endpoint, the RPC runtime on the client contacts the RPC endpoint mapper (RPCSS) on the server at a well-known port (135) and obtains the port to connect to for the service supporting desired RPC interface. This assumes that the client does not know the complete binding. This is the case with all AD RPC services.
The service registers one or more endpoints when it starts, and has the choice of a dynamically assigned port or a specific port.
If you configure Active Directory and Netlogon to run at "port x" as in the following entry, this becomes the ports that are registered with the endpoint mapper in addition to the standard dynamic port.
Use Registry Editor to modify the following values on each domain controller where the restricted ports are to be used. Member servers are not considered to be logon servers, therefore static port assigment for NTDS has no effect on them.
Member servers do have the Netlogon RPC Interface, but it is rarely used. Some examples would maybe be remote configuration retrieval such as "nltest /server:member.contoso.com /sc_query:contoso.com".
Registry key 1
Registry value: TCP/IP Port
Value type: REG_DWORD
Value data: (available port)
You need to restart the computer for the new setting to become effective.
Registry key 2
Registry value: DCTcpipPort
Value type: REG_DWORD
Value data: (available port)
You need to restart the Netlogon service for the new setting to become effective.Note
When you use the DCTcpipPort registry entry, and you set it to the same port as the "TCP/IP Port" registry entry, you receive Netlogon error event 5809 under NTDS\Parameters. This indicates that the port configured is in use, and you shoudl choose a different port.
You will receive the same event when you have a unique port, and you restart the Netlogon service on the domain controller. This is by design, and occurs because of the way the RPC runtime manages its server ports. The port for Netlogon is still being registered with the runtime, even when you stop the Netlogon service. The port will be used after the restart, and the event can be ignored.
Administrators should confirm that the communication over the specified port is enabled if any intermediate network devices or software is used to filter packets between the domain controllers.
Frequently, you must also manually set the File Replication Service (FRS) RPC port because AD and FRS replication replicate with the same Domain Controllers. The File Replication Service (FRS) RPC port should use a different port.
For more information, click the following article number to view the article in the Microsoft Knowledge Base:
How to restrict FRS replication traffic to a specific static port
If you are setting the Active Directory replication to a fixed port outside the range that is allowed for RPC ports to control access and logons through a firewall, the replication port and the dynamic RPC ports will have to be opened on the firewall to allow access and logons. This is because logon uses the Replication Port for user mapping.
You may want to set the Active Directory replication to a fixed port outside the range that is allowed for RPC ports. You may want to do this to control access and logons through a firewall. However, because of this, the replication and Netlogon port must be opened on the firewall. This is because the logon process uses the Replication Port for user mapping.
After you specify the ports, you may encounter the following issues:
Long logon time after you set a specific static port for NTDS and Netlogon in a Windows Server 2008 R2-based domain environment
AD replication fails with an RPC issue after you set a static port for NTDS in a Windows-based domain environment
To resolve the issues, install the updates mentioned in the two articles.
For more information about the RPC Endpoint Mapper, click the following article number to view the article in the Microsoft Knowledge Base:
How to configure RPC dynamic port allocation to work with firewalls