topic Re: Policy for AD authentication across zones in General Topics

Policy for AD authentication across zones

PierreJvR — Tue, 31 May 2016 22:30:01 GMT

Trying to narrow it down and determine the minimum set of applications/services that need to be allowed for a user to login into a Windows 7 client in one zone and authenticate against a Server 2008R2 AD Domain Controller in a different zone? The Windows 7 client is a member of the domain. Need the ability for users to change passwords, access a read-only file share and also for GPO to work.

Any ideas are very much appreciated.

Re: Policy for AD authentication across zones

pulukas — Sun, 05 Jun 2016 12:01:12 GMT

This documentation on MS TechNet details the AD port requirements and their function.

https://technet.microsoft.com/en-us/library/dd772723(v=ws.10).aspx

Re: Policy for AD authentication across zones

PierreJvR — Wed, 08 Jun 2016 14:42:57 GMT

Thanks Steve,

This is a useful TechNet article, but it is about DC to DC communications; I'm looking for client to DC communications info.

Cheers,

Pierre

Re: Policy for AD authentication across zones

pulukas — Fri, 10 Jun 2016 23:51:07 GMT

Can't seem to find the client to DC article. But here are the ports I pulled when setting this up a few years back.

53/tcp and 53/udp (only if the DC is also the DNS source)
749/udp
88/tcp/udp
389/tcp/udp
3268/tcp

445/tcp/udp
123/udp
135/tcp

tcp random range: 49152 to 65535

Re: Policy for AD authentication across zones

OtakarKlier — Wed, 15 Jun 2016 14:07:12 GMT

Hello and sorry for the late reply. Here are the applications I have setup for my cross zone AD authentication:

active-directoy

dns

kerberos

ldap

ms-ds-smb

ms-kms

ms-netlogon

ms-product-activation

msrpc

netbios-dg

netbios-ns

netbios-ss

ntp

ssl

I'm sure you might not need all, but its a start.

Cheers!