#CLIENTS USUALLY USE EPHEMERAL PORTS SOFTWARE#
#CLIENTS USUALLY USE EPHEMERAL PORTS WINDOWS#

Oh, and don’t expect to get this to work through a NAT. The only reliable test is using Microsoft’s PortQry, which tests specific AD ports and the ephemeral ports, and the required responses from the services on the required AD ports it specifically scans for.

#CLIENTS USUALLY USE EPHEMERAL PORTS WINDOWS#

If it’s not your antivirus or security app, and disabling the Windows firewall doesn’t do the trick, then it’s obvious it’s an outside factor – your edge/perimeter firewalls.Īlso to point out, when testing for port blocks, tools such as telnet is not a good tool to test AD/DC to DC connectivity, nor is any sort of standard port scan, such as using nmap, or a simple ping, resolving with nslookup (although resolving required records is a pre-requisite), or other tools. At that point, you’ll need to contact your antivirus vendor to ask them the best way to configure it to allow AD communications and replication. If after uninstalling it, and you find replication now works, well there you have it. Uninstalling it is the best bet, so you know there are no traces of other subcomponents that are active that may still be causing the block.

#CLIENTS USUALLY USE EPHEMERAL PORTS SOFTWARE#

Simply speaking, if there are replication or other AD communication problems, and you have an antivirus software installed on the endpoints or installed on all of your DCs, disable it, or better yet, uninstall it. Whether between locations with firewall/VPN tunnel port blocks, Windows Firewall (which is usually not the culprit because they will auto-configure for the role of the machine and it’s current network location), or even security software or antivirus apps with some sort of “network traffic protection” feature enabled that is causing the problem. If so, you’ve been succumbed to the fact and realization there are possibly necessary ports being blocked causing these familiar AD communications errors. RPC server not available? Replication errors in the Event viewer? Sound familiar?

But it is what it is, and it is what we need to follow to make AD work.

Yes, they are extensive, to the dismay of the network group in your organization. I thought to clean up and re-publish my blog on AD ports requirements.

Clients usually use ephemeral ports