Port 3268 (Active Directory Global Catalog)
LDAP queries across a whole AD forest (3269 with TLS).
- Transport
- TCP
- Internet exposure
- Never expose
Should not be reachable from the internet.
Security notes
- Same reconnaissance value as LDAP, across every domain in the forest.
When it shows up in your logs
Bulk queries from a workstation can be AD enumeration.