Firewall ports for adding a machine to a domain

[acl03]

I have a domain in that sits behind a firewall. I want to add a server to this domain that is on a different firewall.

What ports do I need open between the new member server and the DC's in order to get the server to connect?

Also, if I want to add a new DC in this second location, what ports does it need open to communicate with the rest of the domain? Thanks.



Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[58sniper]

You'd be better off implementing a site-to-site VPN if the path between them is the Internet.

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[acl03]

Thanks, Pat.

The sites are both in our LAN, just in different DMZ segments. A VPN isn't necessary, just whatever ports AD requires would need to be opened.



Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[Zelandakh]

GC would be 3268 but you may need NetBIOS on 135. Never tried it though.

 

[58sniper]

Plus time sync on 123

Pat Richard MVP
Plan for performance, and capacity takes care of itself. Plan for capacity, and suffer poor performance.

http://www.ucblogs.net/blogs/exchange/

 

[kmills]

And DNS on 53

 

[acl03]

Just came across this...

http://geekswithblogs.net/TSCustomiser/archive/2007/05/09/112357.aspx

Looks pretty complete.



Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[technome]

Fully open all the ports needed, and your firewall might as well be Swiss cheese next to a rat nest.
Agree will 58Sniper, use a VPN

........................................
Chernobyl disaster..a must see pictorial

http://www.kiddofspeed.com/default.htm

 

[acl03]

The firewall for starters isn't even necessary in this case, as it's all internal. I could bore you with the specifics, but I doub't it'd be too interesting

There is more than one firewall protecting this whole system from the internet, it's just two enclosed systems talking to each other.



Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[acl03]

I had most of the ports opened that were listed in that link I posted above. Our security officer didn't want to open the 'TCP High Ports' (ports > 1023).

I found a guide documenting how to restrict RPC to use certain ports, rather than anything over 1023, with registry changes.

http://support.microsoft.com/kb/832017/

Do these registry changes need to be made on every domain controller in the domain? Or only the servers in each of the 2 sites that communicate with each other?

Thanks.

Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!

 

[acl03]

Actually, this is the article describing how to do this...

http://support.microsoft.com/kb/154596/

Thanks,
Andrew

Hard work often pays off over time, but procrastination pays off right now!