AD-DCD-01: DC non-standard LDAP port count should be retrievable
| ID | AD-DCD-01 |
| Severity | Info |
| Suite | Active Directory (on-premises) |
| Product | Active Directory |
| Feature | Domain controllers |
| Security area | Infrastructure hardening |
| Resource type | DomainController |
| Reads from | On-premises Active Directory |
What this checks and how to fix it
Section titled “What this checks and how to fix it”Domain controllers typically use the standard LDAP port (389) for directory services communication. Non-standard LDAP ports may indicate:
- Custom configurations that could affect compatibility with standard LDAP clients and tools
- Security evasion attempts where alternate ports are used to bypass network monitoring
- Legacy configurations that haven’t been updated to standard settings
- Multi-tenant or specialized deployments with unique port requirements
While non-standard ports may be intentional for specific scenarios, they can cause issues with:
- LDAP client connectivity
- Directory synchronization services
- Authentication protocols expecting standard ports
- Network security monitoring and firewall rules
Control Type
Section titled “Control Type”Detective
Security Recommendation
Section titled “Security Recommendation”- Document intentional deviations: If non-standard ports are required, ensure they are well-documented with business justification
- Review firewall rules: Ensure proper firewall rules are in place for any non-standard ports
- Monitor for unauthorized changes: Non-standard ports without documentation may indicate unauthorized configuration changes
- Consider standardization: Where possible, use standard ports to simplify management and troubleshooting
How the Test Works
Section titled “How the Test Works”This test retrieves all domain controllers and checks their configured LDAP port. The standard LDAP port is 389. The test reports:
- Total number of domain controllers
- Number of DCs using the standard LDAP port (389)
- Number of DCs using non-standard LDAP ports
- Names of DCs with non-standard ports and the specific ports they use
Related Tests
Section titled “Related Tests”Test-MtAdDcNonStandardLdapsPortCount- Checks for non-standard secure LDAP portsTest-MtAdDcSiteCoverageCount- Analyzes DC distribution across sites
Mito check. Author: soulemike. Open-source licences.
Open-source licences. CIS Benchmark material © Center for Internet Security, Inc.; CISA SCuBA baselines are public domain (CC0).
© 2026 Virtual Petals. Mito is a Virtual Petals service, hosted in Microsoft Azure UAE North.