Help and Support

Service overview and network port = requirements for=20 the Windows Server system

Vi= ew=20 products that this article applies to.

Article ID	:	832017
Last Review	:	October 11, 2007
Revision	:	33.1

SUMMARY

This article discusses the essential = network ports,=20 protocols and services that are used by Microsoft client and = server=20 operating systems, server-based programs and their = subcomponents in=20 the Microsoft Windows server system. Administrators and = support=20 professionals may use this Microsoft Knowledge Base article = as a=20 road-map to determine what ports and protocols Microsoft = operating=20 systems and programs require for network connectivity in a = segmented=20 network.

The port information in this article should = not be=20 used to configure Windows Firewall. For information about=20 configuring Windows Firewall, visit the following Microsoft = Web=20 site:

Microsoft Firewall Technical=20 Reference
http://technet2.microsoft.com/window= sserver/en/library/6490c9fc-6c06-4304-b61c-5577af1445d01033.mspx=20 = (http://technet2.microsoft.com/windowsserver/en/library/6490c9fc-6c06-430= 4-b61c-5577af1445d01033.mspx)

The=20 Windows server system includes a comprehensive and = integrated=20 infrastructure that is designed to meet the requirements of=20 developers and of information technology (IT) professionals. = This=20 system is designed to run programs and solutions that = information=20 workers can use to obtain, to analyze, and to share = information=20 quickly and easily. These Microsoft client, server and = server=20 program products use a variety of network ports and = protocols to=20 communicate with client systems and with other server = systems over=20 the network. Dedicated firewalls, host-based firewalls, and = Internet=20 Protocol security (IPsec) filters are other important = components=20 that are required to help secure your network. However, if = these=20 technologies are configured to block ports and protocols = that are=20 used by a specific server, that server will no longer = respond to=20 client requests.

Back=20 to the top

Overview

The following list provides an overview of the information = that this=20 article contains:=20

=E2=80=A2	The "System=20 services ports" section of this article = contains a=20 brief description of each service, displays the = logical name=20 of that service, and indicates the ports and protocols = that=20 each service requires for correct operation. Use this = section=20 to help identify the ports and protocols that a = particular=20 service uses.
=E2=80=A2	The "Ports=20 and protocols" section of this article = includes a=20 table that summarizes the information from the "System = Services Ports" section. The table is sorted by port = number=20 instead of by the service name. Use this section to = quickly=20 determine which services listen on a particular=20 port.

This article uses certain = terms in=20 specific ways. To help avoid confusion, make sure that you=20 understand how this document uses these terms. The following = list=20 describes these terms:=20

=E2=80=A2	System services: The Windows = server=20 system includes many products, such as the Microsoft = Windows=20 2000 Server family, Microsoft Windows Server 2003 = family,=20 Microsoft Exchange 2000 Server, and Microsoft SQL = Server 2000.=20 Each of these products include many components; system = services is one of those components. System services = that are=20 required by a particular computer are either started=20 automatically by the operating system during startup = or are=20 started as required during typical operations. For = example,=20 some system services that are available on computers = that are=20 running Windows Server 2003, Enterprise Edition, = include the=20 Server service, the Print Spooler service, and the = World Wide=20 Web Publishing Service. Each system service has a = friendly=20 service name and a service name. The friendly service = name is=20 the name that appears in graphical management tools = such as=20 the Services Microsoft Management Console (MMC) = snap-in. The=20 service name is the name that is used with = command-line tools=20 and with many scripting languages. Each system service = may=20 provide one or more network services.
=E2=80=A2	Application protocol: In the = context of=20 this article, an application protocol is a high-level = network=20 protocol that uses one or more TCP/IP protocols and = ports.=20 Examples of application protocols include Hypertext = Transfer=20 Protocol (HTTP), server message blocks (SMBs), and = Simple Mail=20 Transfer Protocol (SMTP).
=E2=80=A2	Protocol: Operating at a lower = level=20 than the application protocols, TCP/IP protocols are = standard=20 formats for communicating between devices on a = network. The=20 TCP/IP suite of protocols includes TCP, User Datagram = Protocol=20 (UDP), and Internet Control Message Protocol = (ICMP).
=E2=80=A2	Port: This is the network port = that the=20 system service listens on for incoming network=20 traffic.

This article does not = specify=20 which services rely on other services for network = communication. For=20 example, many services rely on the remote procedure call = (RPC) or=20 DCOM features in Microsoft Windows to assign them dynamic = TCP ports.=20 The Remote Procedure Call service coordinates requests by = other=20 system services that use RPC or DCOM to communicate with = client=20 computers. Many other services rely on network basic = input/output=20 system (NetBIOS) or SMBs, protocols that are actually = provided by=20 the Server service. Others rely on HTTP or on Hypertext = Transfer=20 Protocol Secure (HTTPS). These protocols are provided by = Internet=20 Information Services (IIS). A full discussion of the = architecture of=20 the Windows operating systems is beyond the scope of this = article.=20 However, detailed documentation on this subject is available = on=20 Microsoft TechNet and on the Microsoft Developer Network = (MSDN).=20 While many services may rely on a particular TCP or UDP = port, only a=20 single service or process can be actively listening on that = port at=20 any one time.

When you use RPC with TCP/IP or with = UDP/IP as=20 the transport, inbound ports are frequently dynamically = assigned to=20 system services as required; TCP/IP and UDP/IP ports that = are higher=20 than port 1024 are used. These are frequently informally = referred to=20 as "random RPC ports." In these cases, RPC clients rely on = the RPC=20 endpoint mapper to tell them which dynamic port(s) were = assigned to=20 the server. For some RPC-based services, you can configure a = specific port instead of letting RPC assign one dynamically. = You can=20 also restrict the range of ports that RPC dynamically = assigns to a=20 small range, regardless of the service. For more information = about=20 this topic, see the "References" section of this=20 article.

This article includes information about the = system=20 services roles and the server roles for the Microsoft = products that=20 are listed in the "Applies to" section at the end of this = article.=20 While this information may also apply to Microsoft Windows = XP and to=20 Microsoft Windows 2000 Professional, this article is = intended to=20 focus on server-class operating systems. Because of this, = this=20 article describes the ports that a service listens on = instead of the=20 ports that client programs use to connect to a remote=20 system.

Back=20 to the top

System services ports

This section provides a description of each system service, = includes=20 the logical name that corresponds to the system service, and = displays the ports and the protocols that each service = requires.

Active Directory (Local Security = Authority)

Active Directory runs under the LSASS process and includes = the=20 authentication and replication engines for Windows 2000 and = Windows=20 Server 2003 domain controllers. Domain controllers, client = computers=20 and application servers require network connectivity to = Active=20 Directory over specific hard-coded ports in addition to a = range of=20 ephemeral TCP ports between 1024 and 65536 unless a = tunneling=20 protocol is used to encapsulate such traffic, An = encapsulated=20 solution might consist of a VPN gateway located behind a = filtering=20 router using Layer 2 Tunneling Protocol (L2TP) together with = IPsec.=20 In this encapsulated scenario, you must allow IPsec = Encapsulating=20 Security Protocol (ESP) (IP protocol 50), IPsec Network = Address=20 Translator Traversal NAT-T (UDP port 4500), and IPsec = Internet=20 Security Association and Key Management Protocol (ISAKMP) = (UDP port=20 500) through the router as opposed to opening all the ports = and=20 protocols listed below. Finally, the port used for Active = Directory=20 replication may be hard-coded as described in the following = article=20 in the Microsoft Knowledge Base:

224196 = (http://support.microsoft.com/kb/224196/)=20 Restricting Active Directory replication traffic and client = RPC=20 traffic to a specific port

Note Packet filters = for L2TP=20 traffic are not required, because L2TP is protected by IPsec = ESP.=20

System service name: LSASS

Application protocol	Protocol	Ports
Global Catalog Server	TCP	3269
Global Catalog Server	TCP	3268
LDAP Server	TCP	389
LDAP Server	UDP	389
LDAP SSL	TCP	636
LDAP SSL	UDP	636
IPsec ISAKMP	UDP	500
NAT-T	UDP	4500
RPC	TCP	135
RPC randomly allocated high TCP ports	TCP	1024 - = 65536*

* For more=20 information about how to customize this port, see the = "Domain=20 controllers and Active Directory" section in the = "References"=20 section.

Application Layer Gateway Service

This subcomponent of the Internet Connection Sharing = (ICS)/Internet=20 Connection Firewall (ICF) service provides support for = plug-ins that=20 allow network protocols to pass through the firewall and = work behind=20 Internet Connection Sharing. Application Layer Gateway (ALG) = plug-ins can open ports and change data (such as ports and = IP=20 addresses) that are embedded in packets. File Transfer = Protocol=20 (FTP) is the only network protocol with a plug-in that is = included=20 with Windows Server 2003, Standard Edition, and Windows = Server 2003,=20 Enterprise Edition. The ALG FTP plug=E2=80=93in is designed = to support=20 active FTP sessions through the network address translation = (NAT)=20 engine that these components use. The ALG FTP = plug=E2=80=93in supports these=20 sessions by redirecting all traffic that passes through the = NAT and=20 that is destined for port 21 to a private listening port in = the=20 range of 3000 to 5000 on the loopback adapter. The ALG FTP = plug=E2=80=93in=20 then monitors and updates FTP control channel traffic so = that the=20 FTP plug-in can forward port mappings through the NAT for = the FTP=20 data channels. The FTP plug=E2=80=93in also updates ports in = the FTP control=20 channel stream.

System service name: ALG

Application protocol	Protocol	Ports
FTP control	TCP	21

ASP.NET State Service

ASP.NET State Service provides support for ASP.NET = out-of-process=20 session states. ASP.NET State Service stores session data=20 out-of-process. The service uses sockets to communicate with = ASP.NET=20 that is running on a Web server.

System service name: = aspnet_state

Application protocol	Protocol	Ports
ASP.NET Session State	TCP	42424

Certificate Services

Certificate Services is part of the core operating system. = By using=20 Certificate Services, a business can act as its own = certification=20 authority (CA). In this way, the business can issue and = manage=20 digital certificates for programs and protocols such as=20 Secure/Multipurpose Internet Mail Extensions (S/MIME), = Secure=20 Sockets Layer (SSL), Encrypting File System (EFS), IPsec, = and smart=20 card logon. Certificate Services relies on RPC and on DCOM = to=20 communicate with clients by using random TCP ports that are = higher=20 than port 1024.

System service name: CertSvc

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

Cluster Service

The Cluster service controls server cluster operations and = manages=20 the cluster database. A cluster is a collection of = independent=20 computers that act as a single computer. Managers, = programmers, and=20 users see the cluster as a single system. The software = distributes=20 data among the nodes of the cluster. If a node fails, other = nodes=20 provide the services and data that was formerly provided by = the=20 missing node. When a node is added or repaired, the cluster = software=20 migrates some data to that node.

System service name: = ClusSvc

Application protocol	Protocol	Ports
Cluster Services	UDP	3343
RPC	TCP	135
Cluster Administrator	UDP	`137`
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

Computer Browser

The Computer Browser system service maintains an up-to-date = list of=20 computers on your network and supplies the list to programs = that=20 request it. The Computer Browser service is used by = Windows-based=20 computers to view network domains and resources. Computers = that are=20 designated as browsers maintain browse lists that contain = all shared=20 resources that are used on the network. Earlier versions of = Windows=20 programs, such as My Network Places, the net view = command,=20 and Windows Explorer, all require browsing capability. For = example,=20 when you open My Network Places on a computer that is = running=20 Microsoft Windows 95, a list of domains and computers = appears. To=20 display this list, the computer obtains a copy of the browse = list=20 from a computer that is designated as a = browser.

System=20 service name: Browser

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138
NetBIOS Name Resolution	UDP	137
NetBIOS Session Service	TCP	139

DHCP Server

The DHCP Server service uses the Dynamic Host Configuration = Protocol=20 (DHCP) to automatically allocate IP addresses. By using this = service, you can adjust the advanced network settings of = DHCP=20 clients. For example, you can configure network settings = such as=20 Domain Name System (DNS) servers and Windows Internet Name = Service=20 (WINS) servers. You can establish one or more DHCP servers = to=20 maintain TCP/IP configuration information and to provide = that=20 information to client computers.

System service name: = DHCPServer

Application protocol	Protocol	Ports
DHCP Server	UDP	67
MADCAP	UDP	2535

Distributed File System

The Distributed File System (DFS) integrates disparate file = shares=20 that are located across a local area network (LAN) or wide = area=20 network (WAN) into a single logical namespace. The DFS = service is=20 required for Active Directory domain controllers to = advertise the=20 SYSVOL shared folder.

System service name: Dfs

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138
NetBIOS Session Service	TCP	139
LDAP Server	TCP	389
LDAP Server	UDP	389
SMB	TCP	445
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

Distributed File System Replication

The Distributed File System Replication (DFSR) service is a=20 state-based, multi-master file replication engine that = automatically=20 copies updates to files and folders between computers that = are=20 participating in a common replication group. DFSR was added = in=20 Windows Server 2003 R2. You can configure DFSR by using the=20 Dfsrdiag.exe command-line tool to replicate files on = specific ports=20 between Windows Server 2003 R2 computers, regardless of = whether they=20 are participating in Distributed File System Namespaces = (DFSN) or=20 not.

System service name: DFSR

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Distributed=20 File Replication Service" section in the "References" = section.

Distributed Link Tracking Server

The Distributed Link Tracking Server system service stores=20 information so that files that are moved between volumes can = be=20 tracked to each volume in the domain. The Distributed Link = Tracking=20 Server service runs on each domain controller in a domain. = This=20 service enables the Distributed Link Tracking Client service = to=20 track linked documents that have been moved to a location in = another=20 NTFS file system volume in the same domain.

System = service=20 name: TrkSvr

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

Distributed Transaction Coordinator

The Distributed Transaction Coordinator (DTC) system service = is=20 responsible for coordinating transactions that are = distributed=20 across multiple computer systems and resource managers, such = as=20 databases, message queues, file systems, or other=20 transaction-protected resource managers. The DTC system = service is=20 required if transactional components are configured through = COM+. It=20 is also required for transactional queues in Message Queuing = (also=20 known as MSMQ) and SQL Server operations that span multiple = systems.=20

System service name: MSDTC

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Distributed=20 Transaction Coordinator" section in the "References" = section.

DNS Server

The DNS Server service enables DNS name resolution by = answering=20 queries and update requests for DNS names. DNS servers are = required=20 to locate devices and services that are identified by using = DNS=20 names and to locate domain controllers in Active=20 Directory.

System service name: DNS

Application protocol	Protocol	Ports
DNS	UDP	53
DNS	TCP	53

Event Log

The Event Log system service logs event messages that are = generated=20 by programs and by the Windows operating system. Event Log = reports=20 contain information that can be useful in diagnosing = problems.=20 Reports are viewed in Event Viewer. The Event Log service = writes=20 events that are sent by programs, by services, and by the = operating=20 system to log files. The events contain diagnostic = information in=20 addition to errors that are specific to the source program, = the=20 service, or the component. The logs can be viewed = programmatically=20 through the event log APIs or through the Event Viewer in an = MMC=20 snap-in.

System service name: Eventlog

Application protocol	Protocol	Ports
RPC/named pipes (NP)	TCP	139
RPC/NP	TCP	445
RPC/NP	UDP	137
RPC/NP	UDP	138

Note The Event = Log service=20 uses RPC over named pipes. This service has the same = firewall=20 requirements as those of the "File and Printer Sharing" = feature.=20

Microsoft Exchange Server and Outlook = clients

Versions of Microsoft Exchange Server and Exchange clients = have=20 various port and protocol requirements. These requirements = depend=20 upon which version of Exchange Server or Exchange client is = in=20 use.

For Outlook clients to connect to versions of = Exchange=20 prior to Exchange 2003, direct RPC connectivity to the = Exchange=20 server is required. RPC connections made from Outlook to the = Exchange server will first contact the RPC endpoint mapper = (Port TCP=20 135) to request information on the port mappings of the = various=20 endpoints required. The Outlook client then tries to make=20 connections to the Exchange server directly by using these = endpoint=20 ports.

Exchange 5.5 uses two ports for client = communication.=20 One port is for the Information Store, and one port is for = the=20 Directory. Exchange 2000 and 2003 use three ports for client = communication. One port is for the Information Store, one is = for=20 Directory Referral (RFR), and one port is for=20 DSProxy/NSPI.

In most cases, these two or three ports = will be=20 mapped randomly into the range TCP 1024-65534. If required, = these=20 ports can be configured to always bind to a static port = mapping=20 rather than to use the ephemeral ports.

For more = information=20 about how to configure static TCP/IP ports in Exchange = Server, click=20 the following article number to view the article in the = Microsoft=20 Knowledge Base:=20

270836 = (http://support.microsoft.com/kb/270836/)=20 Exchange Server static port mappings

Outlook 2003 = clients=20 support direct connectivity to Exchange servers by using = RPC.=20 However, these clients can also communicate with Exchange = 2003=20 servers that are hosted on Windows Server 2003-based = computers on=20 the Internet. The use of RPC over HTTP communication between = Outlook=20 and Exchange server eliminates the need to expose = unauthenticated=20 RPC traffic across the Internet. Instead, traffic between = the=20 Outlook 2003 client and the Exchange Server 2003 computer is = tunneled within HTTPS packets over TCP port 443 = (HTTPS).

RPC=20 over HTTPS requires that port TCP 443 (HTTPS) be available = between=20 the Outlook 2003 client and the server that is functioning = as the=20 "RPCProxy" device. The HTTPS packets are terminated at the = RPCProxy=20 server and the unwrapped RPC packets are then passed to the = Exchange=20 server on three ports, in similar fashion to the direct RPC = traffic=20 described above. These RPC over HTTPS ports on the Exchange = server=20 are statically mapped to TCP 6001 (the Information Store), = TCP 6002=20 (Directory Referral), and TCP 6004 (DSProxy/NSPI). No = endpoint=20 mapper must be exposed when using RPC over HTTPS = communication=20 between Outlook 2003 and Exchange 2003, since Outlook 2003 = knows to=20 use these statically mapped endpoint ports. In addition, no = global=20 catalog needs to be exposed to the Outlook 2003 client = because the=20 DSProxy/NSPI interface on the Exchange 2003 server will = provide this=20 functionality.

Exchange Server can also provide = support for=20 other protocols, such as SMTP, Post Office Protocol 3 = (POP3), and=20 IMAP.

Application protocol	Protocol	Ports
IMAP	TCP	143
IMAP over SSL	TCP	993
POP3	TCP	110
POP3 over SSL	TCP	995
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*
RPC	TCP	135
RPC over HTTPS	TCP	443
SMTP	TCP	25
SMTP	UDP	25
Information Store	TCP	6001
Directory Referral	TCP	6002
DSProxy/NSPI	TCP	6004

* For more = information=20 about how to customize this port, see the "Remote Procedure = Calls=20 and DCOM" section in the "References" section.

Fax Service

Fax Service, a Telephony API (TAPI)=E2=80=93compliant system = service,=20 provides fax capabilities. By using Fax Service, users can = send and=20 receive faxes from their desktop programs by using either a = local=20 fax device or a shared network fax device.

System = service=20 name: Fax

Application protocol	Protocol	Ports
NetBIOS Session Service	TCP	139
SMB	TCP	445
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

File Replication

The File Replication service (FRS) is a file-based = replication=20 engine that automatically copies updates to files and = folders=20 between computers that are participating in a common FRS = replica=20 set. FRS is the default replication engine that is used to = replicate=20 the contents of the SYSVOL folder between Windows 2000-based = and=20 Windows Server 2003-based domain controllers that are = located in a=20 common domain. FRS may be configured to replicate files and = folders=20 between targets of a DFS root or link by using the DFS=20 Administration tool.

System service name: NtFrs

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the "File=20 Replication Service" section in the "References" section.

File Server for Macintosh

By using the File Server for Macintosh system service, = Macintosh=20 computer users can store and access files on a computer that = is=20 running Windows Server 2003. If this service is turned off = or=20 blocked, Macintosh clients cannot access or store files on = that=20 computer.

System service name: MacFile

Application protocol	Protocol	Ports
File Server for Macintosh	TCP	548

FTP Publishing Service

FTP Publishing Service provides FTP connectivity. By = default, the=20 FTP control port is 21. However, you can configure this = system=20 service through the Internet Information Services (IIS) = Manager=20 snap-in. The default data (that is used for active mode FTP) = port is=20 automatically set to one port less than the control port. = Therefore,=20 if you configure the control port to port 4131, the default = data=20 port is port 4130. Most FTP clients use passive mode FTP. = This means=20 that the client initially connects to the FTP server by = using the=20 control port, the FTP server assigns a high TCP port between = ports=20 1025 and 5000, and then the client opens a second connection = to the=20 FTP server for transferring data. You can configure the = range of=20 high ports by using the IIS metabase.

System service = name:=20 MSFTPSVC

Application protocol	Protocol	Ports
FTP control	TCP	21
FTP default data	TCP	20
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`

Group Policy

To successfully apply Group Policy, a client must be able to = contact=20 a domain controller over the DCOM, ICMP, LDAP, SMB, and RPC=20 protocols. If any one of these protocols are unavailable or = blocked=20 between the client and a relevant domain controller, policy = will not=20 apply or refresh. For a cross-domain logon, where a computer = is in=20 one domain, and the user account is in another, these = protocols may=20 be required for the client, the resource domain, and the = account=20 domain to communicate. ICMP is used for slow link detection. = For=20 more information about slow link detection, click the = following=20 article number to view the article in the Microsoft = Knowledge Base:=20

227260 = (http://support.microsoft.com/kb/227260/) How a=20 slow link is detected for processing user profiles and Group = Policy=20

System service name: Group=20 Policy

Application protocol	Protocol	Ports
DCOM	TCP + UDP	`random port number between 1024 - = 65534`
ICMP (ping)	ICMP
LDAP	TCP	389
SMB	TCP	445
RPC	TCP	135, `random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Domain=20 controllers and Active Directory" section in the = "References"=20 section.

HTTP SSL

The HTTP SSL system service enables IIS to perform SSL = functions.=20 SSL is an open standard for establishing an encrypted = communications=20 channel to help prevent the interception of critical = information,=20 such as credit card numbers. Although this service is = designed to=20 work on other Internet services, it is primarily used to = enable=20 encrypted electronic financial transactions on the World = Wide Web=20 (WWW). You can configure the ports for this service through = the=20 Internet Information Services (IIS) Manager snap-in. =

System=20 service name: HTTPFilter

Application protocol	Protocol	Ports
HTTPS	TCP	443

Internet Authentication Service

Internet Authentication Service (IAS) performs centralized=20 authentication, authorization, auditing, and accounting of = users who=20 are connecting to a network. These users can be on a LAN = connection=20 or on a remote connection. IAS implements the Internet = Engineering=20 Task Force (IETF) standard Remote Authentication Dial-In = User=20 Service (RADIUS) protocol.

System service name: = IAS

Application protocol	Protocol	Ports
Legacy RADIUS	UDP	1645
Legacy RADIUS	UDP	1646
RADIUS Accounting	UDP	1813
RADIUS Authentication	UDP	1812

Internet Connection Firewall = (ICF)/Internet=20 Connection Sharing (ICS)

This system service provides NAT, addressing, and name = resolution=20 services for all computers on your home network or your = small-office=20 network. When the Internet Connection Sharing feature is = enabled,=20 your computer becomes an "Internet gateway" on the network, = and=20 other client computers can then share one connection to the=20 Internet, such as a dial-up connection or a broadband = connection.=20 This service provides basic DHCP and DNS services but will = work with=20 the full-featured Windows DHCP or DNS services. When ICF and = Internet Connection Sharing act as a gateway for the rest of = the=20 computers on your network, they provide DHCP and DNS = services to the=20 private network on the internal network interface. They do = not=20 provide these services on the external-facing interface.=20

System service name: SharedAccess

Application protocol	Protocol	Ports
DHCP Server	UDP	67
DNS	UDP	53
DNS	TCP	53

Kerberos Key Distribution Center

When you use the Kerberos Key Distribution Center (KDC) = system=20 service, users can log on to the network by using the = Kerberos=20 version 5 authentication protocol. As in other = implementations of=20 the Kerberos protocol, the KDC is a single process that = provides two=20 services: the Authentication Service and the Ticket-Granting = Service. The Authentication Service issues ticket granting = tickets,=20 and the Ticket-Granting Service issues tickets for = connection to=20 computers in its own domain.

System service name: = kdc

Application protocol	Protocol	Ports
Kerberos	TCP	88
Kerberos	UDP	88

License Logging

The License Logging system service is a tool that was = originally=20 designed to help customers manage licenses for Microsoft = server=20 products that are licensed in the Server Client Access = License (CAL)=20 model. License Logging was introduced with Microsoft Windows = NT=20 Server 3.51. By default, the License Logging service is = disabled in=20 Windows Server 2003. Because of legacy design constraints = and=20 evolving license terms and conditions, License Logging may = not=20 provide an accurate view of the total number of CALs that = are=20 purchased compared to the total number of CALs that are used = on a=20 particular server or across the enterprise. The CALs that = are=20 reported by License Logging may conflict with the = interpretation of=20 the End-User License Agreement (EULA) and with Product Use = Rights=20 (PUR). License Logging will not be included in future = versions of=20 the Windows operating system. Microsoft recommends that only = users=20 of the Microsoft Small Business Server family of operating = systems=20 enable this service on their servers.

System service = name:=20 LicenseService

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138
NetBIOS Session Service	TCP	139
SMB	TCP	445

Note The License = Logging=20 service uses RPC over named pipes. This service has the same = firewall requirements as those of the "File and Printer = Sharing"=20 feature.

Message Queuing

The Message Queuing system service is a messaging = infrastructure and=20 development tool for creating distributed messaging programs = for=20 Windows. These programs can communicate across heterogeneous = networks and can send messages between computers that may be = temporarily unable to connect to each other. Message Queuing = helps=20 provide security, efficient routing, support for sending = messages=20 within transactions, priority-based messaging, and = guaranteed=20 message delivery.

System service name: MSMQ

Application protocol	Protocol	Ports
MSMQ	TCP	1801
MSMQ	UDP	1801
MSMQ-DCs	TCP	2101
MSMQ-Mgmt	TCP	2107
MSMQ-Ping	UDP	3527
MSMQ-RPC	TCP	2105
MSMQ-RPC	TCP	2103
RPC	TCP	135

Messenger

The Messenger system service sends messages to or receives = messages=20 from users and computers, administrators, and the Alerter = service.=20 This service is not related to Windows Messenger. If you = disable the=20 Messenger service, notifications that are sent to computers = or users=20 who are currently logged on the network are not received.=20 Additionally, the net send command and the net = name=20 command no longer function.

System service name: = Messenger

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138

Microsoft Exchange MTA Stacks

In Microsoft Exchange 2000 Server and Microsoft Exchange = Server=20 2003, the Message Transfer Agent (MTA) is frequently used to = provide=20 backward-compatible message transfer services between = Exchange 2000=20 Server-based servers and Exchange Server 5.5-based servers = in a=20 mixed-mode environment.

System service name: MSExchangeMTA

Application protocol	Protocol	Ports
X.400	TCP	102

Microsoft Operations Manager 2000

Microsoft Operations Manager (MOM) 2000 delivers = enterprise-class=20 operations management by providing comprehensive event = management,=20 proactive monitoring and alerting, reporting, and trend = analysis.=20 After you install MOM 2000 Service Pack 1 (SP1), MOM 2000 no = longer=20 uses a clear text communications channel, and all traffic = between=20 the MOM agent and the MOM server is encrypted over TCP port = 1270.=20 The MOM Administrator console uses DCOM to connect to the = server.=20 This means that administrators who manage the MOM server = over the=20 network must have access to random high TCP = ports.

System=20 service name: one point

Application protocol	Protocol	Ports
MOM-Clear	TCP	51515
MOM-Encrypted	TCP	1270

Microsoft POP3 Service

Microsoft POP3 Service provides e-mail transfer and = retrieval=20 services. Administrators can use this service to store and = manage=20 e-mail accounts on the mail server. When you install = Microsoft POP3=20 Service on the mail server, users can connect to the mail = server and=20 can retrieve e-mail by using an e-mail client that supports = the POP3=20 protocol, such as Microsoft Outlook.

System service = name:=20 POP3SVC

Application protocol	Protocol	Ports
POP3	TCP	110

MSSQLSERVER

MSSQLSERVER is a system service in Microsoft SQL Server = 2000. SQL=20 Server provides a powerful and comprehensive data management = platform. You can configure the ports that each instance of = SQL=20 Server uses by using the Server Network Utility. =

System=20 service name: MSSQLSERVER

Application protocol	Protocol	Ports
SQL over TCP	TCP	1433
SQL Probe	UDP	1434

MSSQL$UDDI

The MSSQL$UDDI system service is installed during the = installation=20 of the Universal Description, Discovery, and Integration = (UDDI)=20 feature of the Windows Server 2003 family of operating = systems.=20 MSSQL$UDDI provides UDDI capabilities in an enterprise. The = SQL=20 Server database engine is the core component of MSSQL$UDDI.=20

System service name: MSSQLSERVER

Application protocol	Protocol	Ports
SQL over TCP	TCP	1433
SQL Probe	UDP	1434

Net Logon

The Net Logon system service maintains a security channel = between=20 your computer and the domain controller to authenticate = users and=20 services. It passes the user's credentials to a domain = controller=20 and returns the domain security identifiers and user rights = for the=20 user. This is typically referred to as pass-through = authentication.=20 Net Logon is configured to start automatically only when a = member=20 computer or domain controller is joined to a domain. In the = Windows=20 2000 Server and Windows Server 2003 families, Net Logon = publishes=20 service resource locator records in the DNS. When this = service runs,=20 it relies on the Server service and on the Local Security = Authority=20 service to listen for incoming requests. On domain member = computers,=20 Net Logon uses RPC over named pipes. On domain controllers, = it uses=20 RPC over named pipes, RPC over TCP/IP, mailslots, and = Lightweight=20 Directory Access Protocol (LDAP).

System service = name:=20 Netlogon

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138
NetBIOS Name Resolution	UDP	137
NetBIOS Session Service	TCP	139
SMB	TCP	445
RPC	TCP	135, `random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Domain=20 controllers and Active Directory" section in the = "References"=20 section.

Note The Net Logon service uses RPC = over=20 named pipes for down-level clients. This service has the = same=20 firewall requirements as those of the "File and Printer = Sharing"=20 feature.

NetMeeting Remote Desktop Sharing

The NetMeeting Remote Desktop Sharing system service allows=20 authorized users to remotely access your Windows desktop = from=20 another personal computer over a corporate intranet by using = Windows=20 NetMeeting. You must explicitly enable this service in = NetMeeting.=20 You can disable or shut down this feature by using an icon = in the=20 Windows notification area.

System service name: = mnmsrvc

Application protocol	Protocol	Ports
Terminal Services	TCP	3389

Network News Transfer Protocol = (NNTP)

The Network News Transfer Protocol (NNTP) system service = allows=20 computers that are running Windows Server 2003 to act as = news=20 servers. Clients can use a news client, such as Microsoft = Outlook=20 Express, to retrieve newsgroups from the server and to read = the=20 headers or the bodies of the articles in each newsgroup.=20

System service name: NNTPSVC

Application protocol	Protocol	Ports
NNTP	TCP	119
NNTP over SSL	TCP	563

Performance Logs and Alerts

The Performance Logs and Alerts system service collects, = based on=20 preconfigured schedule parameters, performance data from = local or=20 remote computers and then writes that data to a log or = triggers a=20 message. Based on the information that is contained in the = named log=20 collection setting, the Performance Logs and Alerts service = starts=20 and stops each named performance data collection. This = service only=20 runs if at least one performance data collection is = scheduled.=20

System service name: SysmonLog

Application protocol	Protocol	Ports
NetBIOS Session Service	TCP	139

Print Spooler

The Print Spooler system service manages all local and = network print=20 queues and controls all print jobs. Print Spooler is the = center of=20 the Windows printing subsystem. It manages the print queues = on the=20 system and communicates with printer drivers and = input/output (I/O)=20 components, such as the USB port and the TCP/IP protocol = suite.=20

System service name: Spooler

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138
NetBIOS Name Resolution	UDP	137
NetBIOS Session Service	TCP	139
SMB	TCP	445

Note The Spooler = service=20 uses RPC over named pipes. This service has the same = firewall=20 requirements as those of the "File and Printer Sharing" = feature.

Remote Installation

You can use the Remote Installation system service to = install=20 Windows 2000, Windows XP, and Windows Server 2003 on = Pre-Boot=20 eXecution Environment (PXE) remote boot-enabled client = computers.=20 The Boot Information Negotiation Layer (BINL) service, the = primary=20 component of Remote Installation Server (RIS), answers PXE = client=20 requests, checks Active Directory for client validation, and = passes=20 client information to and from the server. The BINL service = is=20 installed when you either add the RIS component from = Add/Remove=20 Windows Components, or select it when you initially install = the=20 operating system.

System service name: BINLSVC

Application protocol	Protocol	Ports
BINL	UDP	4011

Remote Procedure Call (RPC)

The Remote Procedure Call (RPC) system service is an = interprocess=20 communication (IPC) mechanism that enables data exchange and = invocation of functionality that reside in a different = process. The=20 different process can be on the same computer, on the LAN, = or in a=20 remote location, and can be accessed over a WAN connection = or over a=20 VPN connection. The RPC service serves as the RPC endpoint = mapper=20 and Component Object Model (COM) Service Control Manager. = Many=20 services depend on the RPC service to start successfully.=20

System service name: RpcSs

Application protocol	Protocol	Ports
RPC	TCP	135
RPC over HTTPS	TCP	593
NetBIOS Datagram Service	UDP	138
NetBIOS Name Resolution	UDP	137
NetBIOS Session Service	TCP	139
SMB	TCP	445

Note The RPC = Endpoint Mapper=20 also offers its services by using named pipes. This service = has the=20 same firewall requirements as those of the "File and Printer = Sharing" feature.

Remote Procedure Call (RPC) Locator

The Remote Procedure Call (RPC) Locator system service = manages the=20 RPC name service database. When this service is turned on, = RPC=20 clients can locate RPC servers. This service is turned off = by=20 default.

System service name: RpcLocator

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138
NetBIOS Name Resolution	UDP	137
NetBIOS Session Service	TCP	139
SMB	TCP	445

Note The RPC = service Locator=20 offers its services by using RPC over named pipes. This = service has=20 the same firewall requirements as those of the "File and = Printer=20 Sharing" feature.

Remote Storage Notification

The Remote Storage Notification system service notifies = users when=20 they read from or write to files that are only available = from a=20 secondary storage media. Stopping this service prevents this = notification.

System service name: Remote_Storage_User_Link

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

Remote Storage Server

The Remote Storage Server system service stores infrequently = used=20 files on a secondary storage medium. If you stop this = service, users=20 cannot move or retrieve files from the secondary storage = media.=20

System service name: Remote_Storage_Server

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

Routing and Remote Access

The Routing and Remote Access service provides multiprotocol = LAN-to-LAN, LAN-to-WAN, VPN, and NAT routing services. = Additionally,=20 the Routing and Remote Access service also provides dial-up = and VPN=20 remote access services. Although Routing and Remote Access = can use=20 all the following protocols, the service typically uses only = a=20 subset of them. For example, if you configure a VPN gateway = that=20 lies behind a filtering router, you will probably use only = one=20 technology. If you use L2TP with IPsec, you must allow IPsec = ESP (IP=20 protocol 50), NAT-T (UDP on port 4500), and IPsec ISAKMP = (UDP on=20 port 500) through the router.

Note Although = NAT-T and=20 IPsec ISAKMP are required for L2TP, these ports are actually = monitored by the Local Security Authority. For additional=20 information about this, see the "References" section of this = article.

System service name: RemoteAccess

Application protocol	Protocol	Ports
GRE (IP protocol 47)	GRE	n/a
IPsec AH (IP protocol 51)	AH	n/a
IPsec ESP (IP protocol 50)	ESP	n/a
L2TP	UDP	1701
PPTP	TCP	1723

Server

The Server system service provides RPC support and file, = print, and=20 named pipe sharing over the network. The Server service = allows the=20 sharing of local resources, such as disks and printers, so = that=20 other users on the network can access them. It also allows = named=20 pipe communication between programs that are running on the = local=20 computer and on other computers. Named pipe communication is = memory=20 that is reserved for the output of one process to be used as = input=20 for another process. The input-accepting process does not = have to be=20 local to the computer.

Note If a computer name = resolves to multiple IP addresses using WINS, or if WINS = failed and=20 the name is resolved using DNS, NetBIOS over TCP/IP (NetBT) = will try=20 to ping the IP address or addresses of the file server. Port = 139=20 communications depend on Internet Control Message Protocol = (ICMP)=20 echo messages. If Internet Protocol version 6 (IPv6) is not=20 installed, port 445 communications will also depend on ICMP = for name=20 resolution. Preloaded Lmhosts entries will bypass the DNS = resolver.=20 If IPv6 is installed on Windows Server 2003-based or Windows = XP-based systems, port 445 communications will not trigger = any ICMP=20 requests.

System service name: lanmanserver

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138
NetBIOS Name Resolution	UDP	137
NetBIOS Session Service	TCP	139
SMB	TCP	445

SharePoint Portal Server

With the SharePoint Portal Server system service, you can = develop an=20 intelligent portal that seamlessly connects users, teams, = and=20 knowledge so that people can take advantage of relevant = information=20 across business processes. Microsoft SharePoint Portal = Server 2003=20 provides an enterprise business solution that integrates = information=20 from various systems into one solution through single = sign-on and=20 enterprise application integration capabilities.

Application protocol	Protocol	Ports
HTTP	TCP	80
HTTPS	TCP	443

Simple Mail Transfer Protocol = (SMTP)

The Simple Mail Transfer Protocol (SMTP) system service is = an e-mail=20 submission and relay agent. It accepts and queues e-mail for = remote=20 destinations, and it retries at specified intervals. Windows = domain=20 controllers use the SMTP service for intersite e-mail-based=20 replication. The Collaboration Data Objects (CDO) for the = Windows=20 Server 2003 COM component can use the SMTP service to submit = and to=20 queue outbound e-mail.

System service name: SMTPSVC

Application protocol	Protocol	Ports
SMTP	TCP	25
SMTP	UDP	25

Simple TCP/IP Services

Simple TCP/IP Services implements support for the following=20 protocols:=20

=E2=80=A2	Echo, port 7, RFC 862
=E2=80=A2	Discard, port 9, RFC 863
=E2=80=A2	Character Generator, port 19, RFC = 864
=E2=80=A2	Daytime, port 13, RFC 867
=E2=80=A2	Quote of the Day, port 17, RFC 865=20

System service name: SimpTcp

Application protocol	Protocol	Ports
Chargen	TCP	19
Chargen	UDP	19
Daytime	TCP	13
Daytime	UDP	13
Discard	TCP	9
Discard	UDP	9
Echo	TCP	7
Echo	UDP	7
Quotd	TCP	17
Quoted	UDP	17

SMS Remote Control Agent

SMS Remote Control Agent is a system service in Microsoft = Systems=20 Management Server (SMS) 2003. SMS Remote Control Agent = provides a=20 comprehensive solution for change and for configuration = management=20 for the Microsoft operating systems. With this solution,=20 organizations can provide relevant software and updates to=20 users.

System service name: Wuser32

Application protocol	Protocol	Ports
SMS Remote Chat	TCP	2703
SMS Remote Chat	UDP	2703
SMS Remote Control (control)	TCP	2701
SMS Remote Control (control)	UDP	2701
SMS Remote Control (data)	TCP	2702
SMS Remote Control (data)	UDP	2702
SMS Remote File Transfer	TCP	2704
SMS Remote File Transfer	UDP	2704

SNMP Service

SNMP Service allows incoming Simple Network Management = Protocol=20 (SNMP) requests to be serviced by the local computer. SNMP = Service=20 includes agents that monitor activity in network devices and = report=20 to the network console workstation. SNMP Service provides a = method=20 of managing network hosts (such as workstation or server = computers,=20 routers, bridges, and hubs) from a centrally-located = computer that=20 is running network management software. SNMP performs = management=20 services by using a distributed architecture of management = systems=20 and agents.

System service name: SNMP

Application protocol	Protocol	Ports
SNMP	UDP	161

SNMP Trap Service

SNMP Trap Service receives trap messages that are generated = by local=20 or by remote SNMP agents and then forwards those messages to = SNMP=20 management programs that are running on your computer. SNMP = Trap=20 Service, when configured for an agent, generates trap = messages if=20 any specific events occur. These messages are sent to a trap = destination. For example, an agent can be configured to = initiate an=20 authentication trap if an unrecognized management system = sends a=20 request for information. Trap destinations include the = computer=20 name, the IP address, or the Internetwork Packet Exchange = (IPX)=20 address of the management system. The trap destination must = be a=20 network-enabled host that is running SNMP management=20 software.

System service name: SNMPTRAP=20

Application protocol	Protocol	Ports
SNMP Traps Outbound	UDP	162

SQL Analysis Server

The SQL Analysis Server system service is a component of SQL = Server=20 2000. With SQL Analysis Server, you can create and manage = OLAP cubes=20 and data mining models. The analysis server may access local = or=20 remote data sources for creating and storing cubes or data = mining=20 models.

Application protocol	Protocol	Ports
SQL Analysis Services	TCP	2725

SQL Server: Downlevel OLAP Client = Support

This system service is used by SQL Server 2000 when the SQL = Analysis=20 Server service has to support connections from downlevel = (OLAP=20 Services 7.0) clients. These are the default ports for OLAP = services=20 that are used by SQL 7.0.

Application protocol	Protocol	Ports
OLAP Services 7.0	TCP	2393
OLAP Services 7.0	TCP	2394

SSDP Discovery Service

SSDP Discovery Service implements Simple Service Discovery = Protocol=20 (SSDP) as a Windows service. SSDP Discovery Service manages = receipt=20 of device presence announcements, updates its cache, and = passes=20 these notifications along to clients with outstanding search = requests. SSDP Discovery Service also accepts registration = of event=20 callbacks from clients, turns these into subscription = requests, and=20 monitors for event notifications. It then passes these = requests=20 along to the registered callbacks. This system service also = provides=20 hosted devices with periodic announcements. Currently, the = SSDP=20 event notification service uses TCP port 5000. Starting with = the=20 next Windows XP service pack, it will rely on TCP port=20 2869.

Note At the time of this writing, the = current=20 Windows XP service pack level is Windows XP Service Pack 1=20 (SP1).

System service name: SSDPRSR

Application protocol	Protocol	Ports
SSDP	UDP	1900
SSDP event notification	TCP	2869
SSDP legacy event notification	TCP	5000

Systems Management Server 2.0

Microsoft Systems Management Server (SMS) 2003 provides a=20 comprehensive solution for change and configuration = management for=20 Microsoft operating systems. With this solution, = organizations can=20 provide relevant software and updates to users quickly and=20 cost-effectively.=20

Application protocol	Protocol	Ports
NetBIOS Datagram Service	UDP	138
NetBIOS Name Resolution	UDP	137
NetBIOS Session Service	TCP	139
RPC	TCP	135
SMB	TCP	445
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

TCP/IP Print Server

The TCP/IP Print Server system service enables = TCP/IP=E2=80=93based printing=20 by using the Line Printer Daemon (LPD) protocol. The LPD = service on=20 the server receives documents from Line Printer Remote (LPR) = utilities that are running on UNIX computers.

System = service=20 name: LPDSVC

Application protocol	Protocol	Ports
LPD	TCP	515

Telnet

The Telnet system service for Windows provides ASCII = terminal=20 sessions to Telnet clients. A Telnet server supports two = types of=20 authentication and supports the following four types of = terminals:=20

American National Standards Institute=20 (ANSI)
VT-100
VT-52
VTNT

System service name: = TlntSvr

Application protocol	Protocol	Ports
Telnet	TCP	23

Terminal Services

Terminal Services provides a multi-session environment that = allows=20 client devices to access a virtual Windows desktop session = and=20 Windows-based programs that are running on the server. = Terminal=20 Services allows multiple users to be connected interactively = to a=20 computer.

System service name: TermService

Application protocol	Protocol	Ports
Terminal Services	TCP	3389

Terminal Services Licensing

The Terminal Services Licensing system service installs a = license=20 server and provides licenses to registered clients when the = clients=20 connect to a terminal server (a server that has Terminal = Server=20 enabled). Terminal Services Licensing is a low-impact = service that=20 stores the client licenses that have been issued for a = terminal=20 server, and then tracks the licenses that have been issued = to client=20 computers or terminals.

System service name: TermServLicensing

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*
NetBIOS Datagram Service	UDP	138
NetBIOS Name Resolution	UDP	137
NetBIOS Session Service	TCP	139
SMB	TCP	445

* For more = information about=20 how to customize this port, see the "Remote Procedure Calls = and=20 DCOM" section in the "References" = section.

Note=20 Terminal Services Licensing offers its services by using RPC = over=20 named pipes. This service has the same firewall requirements = as=20 those of the "File and Printer Sharing" feature.

Terminal Services Session Directory

The Terminal Services Session Directory system service = allows=20 clusters of load-balanced terminal servers to correctly = route a=20 user's connection request to the server where the user = already has a=20 session running. Users are routed to the first-available = terminal=20 server, regardless of whether they are running another = session in=20 the server cluster. The load-balancing functionality pools = the=20 processing resources of several servers by using the TCP/IP=20 networking protocol. You can use this service with a cluster = of=20 terminal servers to increase the performance of a single = terminal=20 server by distributing sessions across multiple servers. = Terminal=20 Services Session Directory keeps track of disconnected = sessions on=20 the cluster and makes sure that users are reconnected to = those=20 sessions.

System service name: Tssdis

Application protocol	Protocol	Ports
RPC	TCP	135
Randomly allocated high TCP ports	TCP	`random port number between 1024 -=20 65534`*

* = For more=20 information about how to customize this port, see the = "Remote=20 Procedure Calls and DCOM" section in the "References" = section.

Trivial FTP Daemon

The Trivial FTP Daemon system service does not require a = user name=20 or a password and is an integral part of the Remote = Installation=20 Services (RIS). The Trivial FTP Daemon service implements = support=20 for the Trivial FTP Protocol (TFTP) that is defined by the = following=20 RFCs:

RFC 1350 - TFTP
RFC 2347 - Option=20 extension
RFC 2348 - Block size option
RFC 2349 - = Timeout=20 interval, and transfer size options

Trivial File = Transfer=20 Protocol (TFTP) is a file transfer protocol that is designed = to=20 support diskless boot environments. The TFTP service listens = on UDP=20 port 69 but responds from a randomly allocated high port. = Therefore,=20 enabling this port will let the TFTP service receive = incoming TFTP=20 requests, but will not let the selected server respond to = those=20 requests. The service is free to respond to any such request = from=20 any source port it wishes, and the remote client will then = use that=20 port for the duration of the transfer. Communication is=20 bidirectional. If you need to enable this protocol through a = firewall, it may be useful to open UDP port 69 inbound. You = can then=20 rely on other firewall features, which dynamically allow the = service=20 to respond through temporary holes on any other = port.

System=20 service name: tftpd

Application protocol	Protocol	Ports
TFTP	UDP	69

Universal Plug and Play Device Host

The Universal Plug and Play Host discovery system service = implements=20 all the components that are required for device = registration,=20 control, and the response to events for hosted devices. The=20 information that is registered that pertains to a device = (the=20 description, the lifetimes, and the containers) are = optionally=20 stored to disk and are announced on the network after = registration,=20 or when the operating system restarts. The service also = includes the=20 Web server that serves the device, in addition to service=20 descriptions and a presentation page.

System service = name:=20 UPNPHost

Application protocol	Protocol	Ports
UPNP	TCP	2869

Windows Internet Name Service = (WINS)

Windows Internet Name Service (WINS) enables NetBIOS name=20 resolution. This service helps you locate network resources = by using=20 NetBIOS names. WINS servers are required unless all domains = have=20 been upgraded to the Active Directory directory service and = unless=20 all computers on the network are running Windows 2000 or = later. WINS=20 servers communicate with network clients by using NetBIOS = name=20 resolution. WINS replication is only required between WINS = servers.=20

System service name: WINS

Application protocol	Protocol	Ports
NetBIOS Name Resolution	UDP	137
WINS Replication	TCP	42
WINS Replication	UDP	42

Windows Media Services

Windows Media Services in Windows Server 2003 replaces the = following=20 four services that are included in Windows Media Services = versions=20 4.0 and 4.1:=20

Windows Media Monitor Service
Windows = Media=20 Program Service
Windows Media Station Service
Windows = Media=20 Unicast Service

Windows Media Services is now a single = service=20 that runs on Windows Server 2003, Standard Edition; Windows = Server=20 2003, Enterprise Edition; and Windows Server 2003, = Datacenter=20 Edition. Its core components were developed by using the = COM, and it=20 has a flexible architecture that you can customize for = specific=20 programs. It supports a greater variety of control = protocols,=20 including Real Time Streaming Protocol (RTSP), Microsoft = Media=20 Server (MMS) protocol, and HTTP.

System service name: = WMServer

Application protocol	Protocol	Ports
HTTP	TCP	80
MMS	TCP	1755
MMS	UDP	1755
MS Theater	UDP	2460
RTCP	UDP	5005
RTP	UDP	5004
RTSP	TCP	554

Windows Time

The Windows Time system service maintains date and time=20 synchronization on all Windows XP and Windows Server = 2003-based=20 computers on a network. This service uses Network Time = Protocol=20 (NTP) to synchronize computer clocks so that an accurate = clock=20 value, or timestamp is assigned for network validation and = for=20 resource access requests. The implementation of NTP and the=20 integration of time providers help make Windows Time a = reliable and=20 scalable time service for your enterprise. For computers = that are=20 not joined to a domain, you can configure Windows Time to=20 synchronize time with an external time source. If this = service is=20 turned off, the time setting for local computers is not = synchronized=20 with a time service in the Windows domain or with an = externally=20 configured time service. Windows Server 2003 uses NTP. NTP = runs on=20 UDP port 123. The Windows 2000 version of this service uses = Simple=20 Network Time Protocol (SNTP). SNTP also runs on UDP port = 123.=20

When the Windows Time service uses a Windows domain=20 configuration, the service requires domain controller = location and=20 authentication services. Therefore, the ports for Kerberos = and DNS=20 are required.

System service name: W32Time

Application protocol	Protocol	Ports
NTP	UDP	123
SNTP	UDP	123

World Wide Web Publishing Service

World Wide Web Publishing Service provides the = infrastructure that=20 is necessary to register, to manage, to monitor, and to = serve Web=20 sites and programs that are registered with IIS. This system = service=20 contains a process manager and a configuration manager. The = process=20 manager controls the processes where custom applications and = Web=20 sites reside. The configuration manager reads the stored = system=20 configuration for World Wide Web Publishing Service and = makes sure=20 that Http.sys is configured to route HTTP requests to the=20 appropriate application pools or operating system processes. = You can=20 configure the ports that are used by this service through = the=20 Internet Information Services (IIS) Manager snap-in. If the=20 administrative Web site is enabled, a virtual Web site is = created=20 that uses HTTP traffic on TCP port 8098.

System = service=20 name: W3SVC

Application protocol	Protocol	Ports
HTTP	TCP	80
HTTPS	TCP	443

Back=20 to the top

Ports and protocols

The following table summarizes the information from the = "System=20 services ports" section. This table is sorted by = port=20 number instead of by the service name.=20

Port	Protocol	Application protocol	System service name
n/a	GRE	GRE (IP protocol 47)	Routing and Remote Access
n/a	ESP	IPsec ESP (IP protocol 50)	Routing and Remote Access
n/a	AH	IPsec AH (IP protocol 51)	Routing and Remote Access
7	TCP	Echo	Simple TCP/IP Services
7	UDP	Echo	Simple TCP/IP Services
9	TCP	Discard	Simple TCP/IP Services
9	UDP	Discard	Simple TCP/IP Services
13	TCP	Daytime	Simple TCP/IP Services
13	UDP	Daytime	Simple TCP/IP Services
17	TCP	Quotd	Simple TCP/IP Services
17	UDP	Quotd	Simple TCP/IP Services
19	TCP	Chargen	Simple TCP/IP Services
19	UDP	Chargen	Simple TCP/IP Services
20	TCP	FTP default data	FTP Publishing Service
21	TCP	FTP control	FTP Publishing Service
21	TCP	FTP control	Application Layer Gateway Service
23	TCP	Telnet	Telnet
25	TCP	SMTP	Simple Mail Transfer Protocol
25	UDP	SMTP	Simple Mail Transfer Protocol
25	TCP	SMTP	Exchange Server
25	UDP	SMTP	Exchange Server
42	TCP	WINS Replication	Windows Internet Name Service
42	UDP	WINS Replication	Windows Internet Name Service
53	TCP	DNS	DNS Server
53	UDP	DNS	DNS Server
53	TCP	DNS	Internet Connection Firewall/Internet Connection=20 Sharing
53	UDP	DNS	Internet Connection Firewall/Internet Connection=20 Sharing
67	UDP	DHCP Server	DHCP Server
67	UDP	DHCP Server	Internet Connection Firewall/Internet Connection=20 Sharing
69	UDP	TFTP	Trivial FTP Daemon Service
80	TCP	HTTP	Windows Media Services
80	TCP	HTTP	World Wide Web Publishing Service
80	TCP	HTTP	SharePoint Portal Server
88	TCP	Kerberos	Kerberos Key Distribution Center
88	UDP	Kerberos	Kerberos Key Distribution Center
102	TCP	X.400	Microsoft Exchange MTA Stacks
110	TCP	POP3	Microsoft POP3 Service
110	TCP	POP3	Exchange Server
119	TCP	NNTP	Network News Transfer Protocol
123	UDP	NTP	Windows Time
123	UDP	SNTP	Windows Time
135	TCP	RPC	Message Queuing
135	TCP	RPC	Remote Procedure Call
135	TCP	RPC	Exchange Server
135	TCP	RPC	Certificate Services
135	TCP	RPC	Cluster Service
135	TCP	RPC	Distributed File System
135	TCP	RPC	Distributed Link Tracking
135	TCP	RPC	Distributed Transaction Coordinator
135	TCP	RPC	Distributed File Replication Service
135	TCP	RPC	Fax Service
135	TCP	RPC	Microsoft Exchange Server
135	TCP	RPC	File Replication Service
135	TCP	RPC	Group Policy
135	TCP	RPC	Local Security Authority
135	TCP	RPC	Remote Storage Notification
135	TCP	RPC	Remote Storage Server
135	TCP	RPC	Systems Management Server 2.0
135	TCP	RPC	Terminal Services Licensing
135	TCP	RPC	Terminal Services Session Directory
137	UDP	NetBIOS Name Resolution	Computer Browser
137	UDP	NetBIOS Name Resolution	Server
137	UDP	NetBIOS Name Resolution	Windows Internet Name Service
137	UDP	NetBIOS Name Resolution	Net Logon
137	UDP	NetBIOS Name Resolution	Systems Management Server 2.0
138	UDP	NetBIOS Datagram Service	Computer Browser
138	UDP	NetBIOS Datagram Service	Messenger
138	UDP	NetBIOS Datagram Service	Server
138	UDP	NetBIOS Datagram Service	Net Logon
138	UDP	NetBIOS Datagram Service	Distributed File System
138	UDP	NetBIOS Datagram Service	Systems Management Server 2.0
138	UDP	NetBIOS Datagram Service	License Logging Service
139	TCP	NetBIOS Session Service	Computer Browser
139	TCP	NetBIOS Session Service	Fax Service
139	TCP	NetBIOS Session Service	Performance Logs and Alerts
139	TCP	NetBIOS Session Service	Print Spooler
139	TCP	NetBIOS Session Service	Server
139	TCP	NetBIOS Session Service	Net Logon
139	TCP	NetBIOS Session Service	Remote Procedure Call Locator
139	TCP	NetBIOS Session Service	Distributed File System
139	TCP	NetBIOS Session Service	Systems Management Server 2.0
139	TCP	NetBIOS Session Service	License Logging Service
143	TCP	IMAP	Exchange Server
161	UDP	SNMP	SNMP Service
162	UDP	SNMP Traps Outbound	SNMP Trap Service
389	TCP	LDAP Server	Local Security Authority
389	UDP	LDAP Server	Local Security Authority
389	TCP	LDAP Server	Distributed File System
389	UDP	LDAP Server	Distributed File System
443	TCP	HTTPS	HTTP SSL
443	TCP	HTTPS	World Wide Web Publishing Service
443	TCP	HTTPS	SharePoint Portal Server
443	TCP	RPC over HTTPS	Exchange Server 2003
445	TCP	SMB	Fax Service
445	TCP	SMB	Print Spooler
445	TCP	SMB	Server
445	TCP	SMB	Remote Procedure Call Locator
445	TCP	SMB	Distributed File System
445	TCP	SMB	License Logging Service
445	TCP	SMB	Net Logon
464	TCP	Kerberos Password V5	Net Logon
500	UDP	IPsec ISAKMP	Local Security Authority
515	TCP	LPD	TCP/IP Print Server
548	TCP	File Server for Macintosh	File Server for Macintosh
554	TCP	RTSP	Windows Media Services
563	TCP	NNTP over SSL	Network News Transfer Protocol
593	TCP	RPC over HTTPS endpoint mapper	Remote Procedure Call
593	TCP	RPC over HTTPS	Exchange Server
636	TCP	LDAP SSL	Local Security Authority
636	UDP	LDAP SSL	Local Security Authority
993	TCP	IMAP over SSL	Exchange Server
995	TCP	POP3 over SSL	Exchange Server
1067	TCP	Installation Bootstrap Service	Installation Bootstrap protocol server
1068	TCP	Installation Bootstrap Service	Installation Bootstrap protocol client
1270	TCP	MOM-Encrypted	Microsoft Operations Manager 2000
1433	TCP	SQL over TCP	Microsoft SQL Server
1433	TCP	SQL over TCP	MSSQL$UDDI
1434	UDP	SQL Probe	Microsoft SQL Server
1434	UDP	SQL Probe	MSSQL$UDDI
1645	UDP	Legacy RADIUS	Internet Authentication Service
1646	UDP	Legacy RADIUS	Internet Authentication Service
1701	UDP	L2TP	Routing and Remote Access
1723	TCP	PPTP	Routing and Remote Access
1755	TCP	MMS	Windows Media Services
1755	UDP	MMS	Windows Media Services
1801	TCP	MSMQ	Message Queuing
1801	UDP	MSMQ	Message Queuing
1812	UDP	RADIUS Authentication	Internet Authentication Service
1813	UDP	RADIUS Accounting	Internet Authentication Service
1900	UDP	SSDP	SSDP Discovery Service
2101	TCP	MSMQ-DCs	Message Queuing
2103	TCP	MSMQ-RPC	Message Queuing
2105	TCP	MSMQ-RPC	Message Queuing
2107	TCP	MSMQ-Mgmt	Message Queuing
2393	TCP	OLAP Services 7.0	SQL Server: Downlevel OLAP Client Support
2394	TCP	OLAP Services 7.0	SQL Server: Downlevel OLAP Client Support
2460	UDP	MS Theater	Windows Media Services
2535	UDP	MADCAP	DHCP Server
2701	TCP	SMS Remote Control (control)	SMS Remote Control Agent
2701	UDP	SMS Remote Control (control)	SMS Remote Control Agent
2702	TCP	SMS Remote Control (data)	SMS Remote Control Agent
2702	UDP	SMS Remote Control (data)	SMS Remote Control Agent
2703	TCP	SMS Remote Chat	SMS Remote Control Agent
2703	UPD	SMS Remote Chat	SMS Remote Control Agent
2704	TCP	SMS Remote File Transfer	SMS Remote Control Agent
2704	UDP	SMS Remote File Transfer	SMS Remote Control Agent
2725	TCP	SQL Analysis Services	SQL Analysis Server
2869	TCP	UPNP	Universal Plug and Play Device Host
2869	TCP	SSDP event notification	SSDP Discovery Service
3268	TCP	Global Catalog Server	Local Security Authority
3269	TCP	Global Catalog Server	Local Security Authority
3343	UDP	Cluster Services	Cluster Service
3389	TCP	Terminal Services	NetMeeting Remote Desktop Sharing
3389	TCP	Terminal Services	Terminal Services
3527	UDP	MSMQ-Ping	Message Queuing
4011	UDP	BINL	Remote Installation
4500	UDP	NAT-T	Local Security Authority
5000	TCP	SSDP legacy event notification	SSDP Discovery Service
5004	UDP	RTP	Windows Media Services
5005	UDP	RTCP	Windows Media Services
6001	TCP	Information Store	Exchange Server 2003
6002	TCP	Directory Referral	Exchange Server 2003
6004	TCP	DSProxy/NSPI	Exchange Server 2003
42424	TCP	ASP.Net Session State	ASP.NET State Service
51515	TCP	MOM-Clear	Microsoft Operations Manager 2000
1024-65534	TCP	RPC	Randomly allocated high TCP=20 ports

Microsoft provides the = information in=20 this table in a Microsoft Excel worksheet. This worksheet is = available for download from the Microsoft Download = Center:
Download=20 the = Port_Requirements_for_Microsoft_Windows_Server_System.xls=20 package now.=20 = (http://download.microsoft.com/download/1/5/c/15c5287d-7a49-4c83-8ce0-aea= 7641b1835/Port_Requirements_for_Microsoft_Windows_Server_System.xls)

Active Directory port and protocol=20 requirements

Application servers, client computers and domain controllers = that=20 are located in common or external forests have service = dependencies=20 so that user and computer initiated operations like domain = join,=20 logon authentication, remote administration, and Active = Directory=20 replication work correctly. Such services and operations = require=20 network connectivity over specific port and networking = protocols.=20

A summarized list of services, ports and protocols = required=20 for member computers and domain controllers to inter-operate = with=20 each other or for application servers to access Active = Directory=20 include but are not limited to the following.

Services on which Active Directory = depends

=E2=80=A2	Active Directory / LSA
=E2=80=A2	Computer Browser
=E2=80=A2	Distributed File System
=E2=80=A2	File Replication Service
=E2=80=A2	Kerberos Key Distribution = Center
=E2=80=A2	Net Logon
=E2=80=A2	Remote Procedure Call (RPC)
=E2=80=A2	Server
=E2=80=A2	Simple Mail Transfer Protocol (SMTP) = (if so=20 configured)
=E2=80=A2	WINS (in Windows Server 2003 SP1 and = later=20 versions for backup Active Directory replication = operations,=20 if DNS is not working)
=E2=80=A2	Windows Time
=E2=80=A2	World Wide Web Publishing=20 Service

Services that require Active Directory=20 services

=E2=80=A2	Certificate Services (required for = specific=20 configurations)
=E2=80=A2	DHCP Server (if so = configured)
=E2=80=A2	Distributed File System
=E2=80=A2	Distributed Link Tracking Server = (optional but=20 on by default on Windows 2000 computers)
=E2=80=A2	Distributed Transaction = Coordinator
=E2=80=A2	DNS Server (if so configured)
=E2=80=A2	Fax Service (if so = configured)
=E2=80=A2	File Replication Service
=E2=80=A2	File Server for Macintosh (if so=20 configured)
=E2=80=A2	Internet Authentication Service (if so=20 configured)
=E2=80=A2	License Logging (on by = default)
=E2=80=A2	Net Logon
=E2=80=A2	Print Spooler
=E2=80=A2	Remote Installation (if so = configured)
=E2=80=A2	Remote Procedure Call (RPC) = Locator
=E2=80=A2	Remote Storage Notification
=E2=80=A2	Remote Storage Server
=E2=80=A2	Routing and Remote Access
=E2=80=A2	Server
=E2=80=A2	Simple Mail Transfer Protocol (SMTP) = (if so=20 configured)
=E2=80=A2	Terminal Services
=E2=80=A2	Terminal Services Licensing
=E2=80=A2	Terminal Services Session=20 Directory

Back=20 to the top

REFERENCES

The Help files for each of the Microsoft = products=20 that are described in this article contain additional = information=20 that you may find useful to help configure your programs. = Windows=20 Server 2003 Help contains step-by-step instructions about = how to=20 configure specific technologies and server roles. =

For more=20 information about a related topic, click the following = article=20 number to view the article in the Microsoft Knowledge Base:=20

179442 = (http://support.microsoft.com/kb/179442/) How to=20 configure a firewall for domains and trusts

Back=20 to the top

General information

For more information about how to help secure Windows Server = 2003=20 and for sample IPsec filters for specific server roles, see = the=20 "Windows Server 2003 Security Guide." To see this guide, = visit the=20 following Microsoft Web site:=20

http://www.microsoft.com/technet/security/prodte= ch/windowsserver2003/w2003hg/sgch00.mspx=20 = (http://www.microsoft.com/technet/security/prodtech/windowsserver2003/w20= 03hg/sgch00.mspx)

For=20 more information about operating system services, security = settings,=20 and IPsec filtering, see the "Threats and Countermeasures = Guide." To=20 see this guide, visit the following Microsoft Web site:=20

http://www.microsoft.com/technet/security/topics/servers= ecurity/tcg/tcgch00.mspx=20 = (http://www.microsoft.com/technet/security/topics/serversecurity/tcg/tcgc= h00.mspx)

For=20 more information about port assignments for well-known = ports, click=20 the following article number to view the article in the = Microsoft=20 Knowledge Base:=20

174904 = (http://support.microsoft.com/kb/174904/)=20 Information about TCP/IP port assignments =

Additionally, see=20 "Appendix B - Port Reference for MS TCP/IP" in the Microsoft = Windows=20 NT 4.0 Resource Kit. To do so, visit the following Microsoft = Web=20 site:=20

http://www.microsoft.com/resources/doc= umentation/windowsnt/4/server/reskit/en-us/net/port_nts.mspx=20 = (http://www.microsoft.com/resources/documentation/windowsnt/4/server/resk= it/en-us/net/port_nts.mspx)

Additionally,=20 see "TCP and UDP Port Assignments" in the Windows 2000 = Server=20 Resource Kit. To do so, visit the following Microsoft Web = site:

http://www.microsoft.com/technet/prodtechnol/= windows2000serv/reskit/default.mspx?mfr=3Dtrue=20 = (http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/defa= ult.mspx?mfr=3Dtrue)

Additionally,=20 see the "Port Assignments and Protocol Numbers" document = from the=20 Windows 2000 Resource Kits. To do so, visit the following = Microsoft=20 Web site:=20

http://www.microsoft.com/technet/p= rodtechnol/windows2000serv/reskit/cnet/cnfc_por_zqyu.mspx?mfr=3Dtrue<= /SPAN>=20 = (http://www.microsoft.com/technet/prodtechnol/windows2000serv/reskit/cnet= /cnfc_por_zqyu.mspx?mfr=3Dtrue)

The=20 Internet Assigned Numbers Authority coordinates the use of=20 well-known ports. To view this organization's list of TCP/IP = port=20 assignments, visit the following Web site:

http://www.iana.org= /assignments/port-numbers=20 (http://www.iana.org/assignments/port-numbers)

Back=20 to the top

Remote Procedure Calls and DCOM

For a detailed discussion of DCOM, see the "Using = Distributed COM=20 with Firewalls" white paper. To do so, visit the following = Microsoft=20 Web site:

http://ms= dn2.microsoft.com/en-us/library/ms809327.aspx=20 = (http://msdn2.microsoft.com/en-us/library/ms809327.aspx)

For = a detailed description of RPC, visit the following Microsoft = Web=20 site:

http://ms= dn2.microsoft.com/en-us/library/ms950395.aspx=20 = (http://msdn2.microsoft.com/en-us/library/ms950395.aspx)

For = more information about configuring RPC to work with a = firewall,=20 click the following article number to view the article in = the=20 Microsoft Knowledge Base:=20

154596 = (http://support.microsoft.com/kb/154596/) How to=20 configure RPC dynamic port allocation to work with firewalls =

For more information about the RPC protocol and how = computers=20 that are running Windows 2000 initialize, see the "Windows = 2000=20 Startup and Logon Traffic Analysis" white paper. To do this, = visit=20 the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/wi= ndows2000serv/deploy/confeat/w2kstart.mspx=20 = (http://www.microsoft.com/technet/prodtechnol/windows2000serv/deploy/conf= eat/w2kstart.mspx)

Back=20 to the top

Domain controllers and Active = Directory

For more information about how to restrict Active Directory=20 replication and client logon traffic, click the following = article=20 number to view the article in the Microsoft Knowledge Base:=20

224196 = (http://support.microsoft.com/kb/224196/)=20 Restricting Active Directory replication traffic and client = RPC=20 traffic to a specific port

For an explanation of how = the=20 Directory System Agent, LDAP, and the local system authority = are=20 related, visit the following Microsoft Web site:=20

http://ms= dn2.microsoft.com/en-us/library/ms675902.aspx=20 = (http://msdn2.microsoft.com/en-us/library/ms675902.aspx)

For = additional information about how LDAP and the global catalog = work in=20 Windows 2000, visit the following Microsoft Web site:=20

http://technet2.microsoft= .com/WindowsServer/en/library/440e44ab-ea05-4bd8-a68c-12cf8fb1af501033.ms= px?mfr=3Dtrue=20 = (http://technet2.microsoft.com/WindowsServer/en/library/440e44ab-ea05-4bd= 8-a68c-12cf8fb1af501033.mspx?mfr=3Dtrue)

Back=20 to the top

Exchange Server

For more information about how to restrict Exchange 2000 = Server and=20 Exchange Server 2003 MAPI traffic, click the following = article=20 number to view the article in the Microsoft Knowledge Base:=20

270836 = (http://support.microsoft.com/kb/270836/)=20 Exchange 2000 and Exchange 2003 static port mappings =

For more=20 information about the network ports and protocols that are = supported=20 by Exchange 2000 Server, click the following article number = to view=20 the article in the Microsoft Knowledge Base:=20

278339 = (http://support.microsoft.com/kb/278339/)=20 TCP/UDP ports used by Exchange 2000 Server

For more=20 information about the ports that are used by Exchange Server = 5.5 and=20 earlier versions of Exchange Server, click the following = article=20 number to view the article in the Microsoft Knowledge Base:=20

176466 = (http://support.microsoft.com/kb/176466/) TCP=20 Ports and Microsoft Exchange: In-depth discussion =

There may be=20 additional items to consider for your particular = environment. For=20 more information and for help with planning an Exchange=20 implementation, visit the following Microsoft Web site:

http://= technet.microsoft.com/en-us/library/bb123872.aspx=20 = (http://technet.microsoft.com/en-us/library/bb123872.aspx)

Fo= r=20 more information, click the following article numbers to = view the=20 articles in the Microsoft Knowledge Base:=20

280132 = (http://support.microsoft.com/kb/280132/)=20 Exchange 2000 Windows 2000 connectivity through firewalls =

282446 = (http://support.microsoft.com/kb/282446/)=20 DSProxy configuration for static ports on Exchange cluster =

827330 = (http://support.microsoft.com/kb/827330/) How to=20 troubleshoot client RPC over HTTP connection issues in = Office=20 Outlook 2003

833401 = (http://support.microsoft.com/kb/833401/) How to=20 configure RPC over HTTP in Exchange Server 2003

Back=20 to the top

File Replication Service

For more information about how to configure FRS to work with = a=20 firewall, click the following article number to view the = article in=20 the Microsoft Knowledge Base:=20

319553 = (http://support.microsoft.com/kb/319553/) How to=20 restrict FRS replication traffic to a specific static port =

Back=20 to the top

Distributed File Replication = Service

The Distributed File Replication Service includes the = Dfsrdiag.exe=20 command-line tool. Dfsrdiag.exe can set the server RPC port = that is=20 used for administration and replication. To use Dfsrdiag.exe = to set=20 the server RPC port, follow this example:

dfsrdiag = StaticRPC=20 /port:nnnnn=20 /Member:Branch01.sales.contoso.com

In = this=20 example, nnnnn represents a single, static RPC = port that=20 DFSR will use for replication.= Branch01.sales.contoso.com=20 represents the DNS or NetBIOS name of the target member = computer. If=20 no member is specified, Dfsrdiag.exe uses the local = computer.

Back=20 to the top

Internet Information Services

For more information about the ports that are used by IIS = 4.0, by=20 IIS 5.0, and by IIS 5.1, click the following article number = to view=20 the article in the Microsoft Knowledge Base:=20

327859 = (http://support.microsoft.com/kb/327859/)=20 Inetinfo services use additional ports beyond well-known = ports=20

For information about how FTP works, visit the = following=20 Microsoft Web site:

http://technet2.microsoft= .com/WindowsServer/en/library/3454a19f-ac86-4a50-8049-c72ee801cd321033.ms= px?mfr=3Dtrue=20 = (http://technet2.microsoft.com/WindowsServer/en/library/3454a19f-ac86-4a5= 0-8049-c72ee801cd321033.mspx?mfr=3Dtrue)

Back=20 to the top

IPsec and VPNs

For more information about how to configure IPSec default = exemptions=20 in Windows, click the following article number to view the = article=20 in the Microsoft Knowledge Base:=20

811832 = (http://support.microsoft.com/kb/811832/) IPsec=20 default exemptions can be used to bypass IPsec protection in = some=20 scenarios

For more information about the ports and = protocols=20 that are used by IPSec, click the following article number = to view=20 the article in the Microsoft Knowledge Base:=20

233256 = (http://support.microsoft.com/kb/233256/) How to=20 enable IPSec traffic through a firewall

For more = information=20 about new and updated features in L2TP and IPSec, click the=20 following article number to view the article in the = Microsoft=20 Knowledge Base:=20

818043 = (http://support.microsoft.com/kb/818043/)=20 L2TP/IPSec NAT-T update for Windows XP and Windows 2000 =

Back=20 to the top

Multicast Address Dynamic Client = Allocation=20 Protocol (MADCAP)

For more information about how to plan MADCAP servers, visit = the=20 following Microsoft Web site:

http://technet2.microsoft= .com/WindowsServer/en/Library/5396ded4-3318-4ca1-84c6-b85a1435d87d1033.ms= px?mfr=3Dtrue=20 = (http://technet2.microsoft.com/WindowsServer/en/Library/5396ded4-3318-4ca= 1-84c6-b85a1435d87d1033.mspx?mfr=3Dtrue)

Back=20 to the top

Message Queuing

For more information about the ports that are used by = Microsoft=20 Message Queuing, click the following article number to view = the=20 article in the Microsoft Knowledge Base:=20

178517 = (http://support.microsoft.com/kb/178517/) TCP=20 ports, UDP ports, and RPC ports that are used by Message = Queuing=20

Back=20 to the top

Mobile Information Server

For more information about the ports that are used by = Microsoft=20 Mobile Information Server 2001, click the following article = number=20 to view the article in the Microsoft Knowledge Base:=20

294297 = (http://support.microsoft.com/kb/294297/) TCP/IP=20 ports used by Microsoft Mobile Information Server

Back=20 to the top

Microsoft Operations Manager

For information about how to plan for and to deploy MOM, = visit the=20 following Microsoft Web site:=20

http://te= chnet.microsoft.com/en-us/opsmgr/default.aspx=20 = (http://technet.microsoft.com/en-us/opsmgr/default.aspx)

Back=20 to the top

Systems Management Server

For more information about the ports that are used by SMS = 2003,=20 click the following article number to view the article in = the=20 Microsoft Knowledge Base:=20

826852 = (http://support.microsoft.com/kb/826852/) Ports=20 that Systems Management Server 2003 uses to communicate = through a=20 firewall or through a proxy server

For more = information about=20 the ports that are used by SMS 2.0, click the following = article=20 number to view the article in the Microsoft Knowledge Base:=20

167128 = (http://support.microsoft.com/kb/167128/)=20 Network ports used by Remote Helpdesk functions

For = more=20 information about how to configure SMS through a firewall, = click the=20 following article number to view the article in the = Microsoft=20 Knowledge Base:=20

200898 = (http://support.microsoft.com/kb/200898/) How to=20 use Systems Management Server 2.0 through a firewall =

For more=20 information about the ports that are used by SMS 2.0 Remote = Tools,=20 click the following article number to view the article in = the=20 Microsoft Knowledge Base:=20

256884 = (http://support.microsoft.com/kb/256884/) TCP=20 and UDP ports that are used by Remote Control have changed = in SMS=20 2.0 Service Pack 2

Back=20 to the top

SQL Server

For more information about how SQL Server 2000 dynamically=20 determines ports for secondary instances, click the = following=20 article number to view the article in the Microsoft = Knowledge Base:=20

286303 = (http://support.microsoft.com/kb/286303/)=20 Behavior of SQL Server 2000 Network Library during dynamic = port=20 detection

For more information about the ports that = are used=20 by SQL Server 7.0 and SQL Server 2000 for OLAP, click the = following=20 article number to view the article in the Microsoft = Knowledge Base:=20

301901 = (http://support.microsoft.com/kb/301901/) TCP=20 ports used by OLAP services when connecting through a = firewall=20

Back=20 to the top

Terminal Services

For more information about how to configure the port that is = used by=20 Terminal Services, click the following article number to = view the=20 article in the Microsoft Knowledge Base:=20

187623 = (http://support.microsoft.com/kb/187623/) How to=20 change Terminal Server's listening port

Back=20 to the top

Controlling communications over the = Internet in=20 Windows

For additional information about how Windows XP Service Pack = 1 (SP1)=20 communicates over the Internet, see the "Using Windows XP=20 Professional with Service Pack 1 in a Managed Environment" = white=20 paper. To do so, visit the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/winxp= pro/maintain/xpmanaged/00_abstr.mspx=20 = (http://www.microsoft.com/technet/prodtechnol/winxppro/maintain/xpmanaged= /00_abstr.mspx)

For=20 additional information about how Windows 2000 Service Pack 4 = (SP4)=20 communicates over the Internet, see the "Using Windows 2000 = with=20 Service Pack 4 in a Managed Environment" white paper. To do = so,=20 visit the following Microsoft Web site:

http://www.microsoft.com/technet/prodtechnol/w= indows2000pro/maintain/w2kmngd/00_abstr.mspx=20 = (http://www.microsoft.com/technet/prodtechnol/windows2000pro/maintain/w2k= mngd/00_abstr.mspx)

For=20 additional information about how Windows Server 2003 = communicates=20 over the Internet, see the "Using Windows Server 2003 in a = Managed=20 Environment" white paper. To do so, visit the following = Microsoft=20 Web site:

http://www.microsoft.com/tech= net/prodtechnol/windowsserver2003/technologies/security/ws03mngd/09_s3fil= .mspx=20 = (http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technolog= ies/security/ws03mngd/09_s3fil.mspx)

Back=20 to the top

APPLIES TO

=E2=80=A2	Microsoft Windows Server 2003 R2 = Standard=20 Edition (32-bit x86)
=E2=80=A2	Microsoft Windows Server 2003 R2 = Enterprise=20 Edition (32-Bit x86)
=E2=80=A2	Microsoft Windows Server 2003, Standard = Edition=20 (32-bit x86)
=E2=80=A2	Microsoft Windows Server 2003, = Enterprise=20 Edition
=E2=80=A2	Microsoft Windows Server 2003, = Datacenter=20 Edition (32-bit x86)
=E2=80=A2	Microsoft Windows Server 2003, Web=20 Edition
=E2=80=A2	Microsoft Systems Management Server = 2003
=E2=80=A2	Microsoft Windows 2000 Professional=20 Edition
=E2=80=A2	Microsoft Windows 2000 Server
=E2=80=A2	Microsoft Windows 2000 Advanced = Server
=E2=80=A2	Microsoft Windows 2000 Datacenter = Server
=E2=80=A2	Microsoft SQL Server 2000 Standard=20 Edition
=E2=80=A2	Microsoft SQL Server 2000 Enterprise=20 Edition
=E2=80=A2	Microsoft Exchange 2000 Server Standard = Edition
=E2=80=A2	Microsoft Exchange 2000 Enterprise = Server
=E2=80=A2	Microsoft Internet Security and = Acceleration=20 Server 2000 Standard Edition
=E2=80=A2	Microsoft Windows XP Home = Edition
=E2=80=A2	Microsoft Windows XP = Professional
=E2=80=A2	Microsoft Windows XP Professional x64=20 Edition
=E2=80=A2	Microsoft Windows XP Tablet PC = Edition
=E2=80=A2	Microsoft Systems Management Server 2.0 = Standard Edition
=E2=80=A2	Microsoft Systems Management Server = 2003
=E2=80=A2	Microsoft SharePoint Portal Server = 2001
=E2=80=A2	Microsoft Operations Manager 2000 = Service Pack=20 1
=E2=80=A2	Microsoft Application Center 2000 = Standard=20 Edition

Back=20 to the top

Keywords:

kbhowtomaster kbfirewall=20 KB832017

Back=20 to the top

Provide feedback on this = article

Did this article help you solve = your=20 problem?

Yes

Partially

I do not know=20 = yet

Strongly Agree

Strongly=20 Disagree

The article is easy to=20 understand

The article is = accurate

Additional = Comments:

To protect your privacy, do = not=20 include contact information in your = feedback.

Thank you! Your feedback is = used to help=20 us improve our support content. For more assistance options, = please=20 visit the Help and = Support=20 Home Page.

Personalize Your Support

Personali= ze=20 your support experience=20

Service overview and network port = requirements for=20 the Windows Server system

On This Page

SUMMARY

Overview

System services ports

Active Directory (Local Security = Authority)

Application Layer Gateway Service

ASP.NET State Service

Certificate Services

Cluster Service

Computer Browser

DHCP Server

Distributed File System

Distributed File System Replication

Distributed Link Tracking Server

Distributed Transaction Coordinator

DNS Server

Event Log

Microsoft Exchange Server and Outlook = clients

Fax Service

File Replication

File Server for Macintosh

FTP Publishing Service

Group Policy

HTTP SSL

Internet Authentication Service

Internet Connection Firewall = (ICF)/Internet=20 Connection Sharing (ICS)

Kerberos Key Distribution Center

License Logging

Message Queuing

Messenger

Microsoft Exchange MTA Stacks

Microsoft Operations Manager 2000

Microsoft POP3 Service

MSSQLSERVER

MSSQL$UDDI

Net Logon

NetMeeting Remote Desktop Sharing

Network News Transfer Protocol = (NNTP)

Performance Logs and Alerts

Print Spooler

Remote Installation

Remote Procedure Call (RPC)

Remote Procedure Call (RPC) Locator

Remote Storage Notification

Remote Storage Server

Routing and Remote Access

Server

SharePoint Portal Server

Simple Mail Transfer Protocol = (SMTP)

Simple TCP/IP Services

SMS Remote Control Agent

SNMP Service

SNMP Trap Service

SQL Analysis Server

SQL Server: Downlevel OLAP Client = Support

SSDP Discovery Service

Systems Management Server 2.0

TCP/IP Print Server

Telnet

Terminal Services

Terminal Services Licensing

Terminal Services Session Directory

Trivial FTP Daemon

Universal Plug and Play Device Host

Windows Internet Name Service = (WINS)

Windows Media Services

Windows Time

World Wide Web Publishing Service

Ports and protocols

Active Directory port and protocol=20 requirements

Services on which Active Directory = depends

Services that require Active Directory=20 services

REFERENCES

General information

Remote Procedure Calls and DCOM

Domain controllers and Active = Directory

Exchange Server

File Replication Service

Distributed File Replication = Service