Don't enable firewall on DC

Can't join the domain after enabling Windows Firewall on Windows 2003 DC

Situation: The client just installed SP1 on the Domain Controller running Windows 2003 server. Now, no one can access the domain and join the domain.

Analysis: To join a domain, the DC must have the following ports open:

TCP port 42 (nameserver service)

TCP port 53 (domain service)

TCP port 88 (kerberos service)

TCP port 135 (epmap service)

UDP port 137 (netbios-ns service)

UDP port 138 (netbios-dgm service)

TCP port 139 (netbios-ssn service)

TCP port 389 (ldap service)

TCP port 445 (microsoft-ds service)

TCP port 636 (ldaps service)

TCP port 3268

TCP port 3269

Resolution: He should turn off Windows Firewall on the DC to use this server role. If for some reasons, he must secure the DC, he may try to use Internet Protocol security (IPsec).

Post your questions, comments, feedbacks and suggestions

Contact a consultant