AD-DCD-02: DC non-standard LDAPS port count should be retrievable

Not run by Mito

This check reads an on-premises Active Directory forest. Mito assesses your Microsoft 365 tenant in the cloud and does not run it. It is listed for reference only.

ID	AD-DCD-02
Severity	Info
Suite	Active Directory (on-premises)
Product	Active Directory
Feature	Domain controllers
Security area	Infrastructure hardening
Resource type	DomainController
Reads from	On-premises Active Directory

What this checks and how to fix it

Domain controllers typically use the standard LDAPS port (636) for secure directory services communication. Non-standard LDAPS ports may indicate:

• Custom SSL/TLS configurations that could affect secure LDAP client connectivity
• Security evasion attempts where alternate ports are used to bypass network monitoring
• Legacy or specialized deployments with unique security requirements
• Load balancer or proxy configurations using different port mappings

Using non-standard LDAPS ports can cause issues with:

• Secure LDAP (LDAPS) client connectivity
• Certificate-based authentication
• Applications hardcoded to use port 636
• Network security monitoring and compliance auditing

Control Type

Detective

Security Recommendation

1. Use standard ports where possible: Port 636 is the industry standard for LDAPS and should be used unless there’s a specific requirement
2. Document security exceptions: Any non-standard ports should be documented with security justification
3. Ensure proper certificate configuration: Non-standard LDAPS ports must have valid SSL/TLS certificates configured
4. Audit regularly: Review non-standard port usage during security audits to detect unauthorized changes

How the Test Works

This test retrieves all domain controllers and checks their configured LDAPS (SSL) port. The standard LDAPS port is 636. The test reports:

• Total number of domain controllers
• Number of DCs using the standard LDAPS port (636)
• Number of DCs using non-standard LDAPS ports
• Names of DCs with non-standard ports and the specific ports they use

Related Tests

• Test-MtAdDcNonStandardLdapPortCount - Checks for non-standard LDAP ports
• Test-MtAdDcReadOnlyCount - Analyzes RODC deployment

---

Mito check. Author: soulemike. Open-source licences.