Networknet archive Blog

PowerShell: Set static RPC ports for Active Directory domain controllers

Originally published Last updated 1 comment

Placing a domain-joined Windows system behind a firewall can be challenging. I put my Web Application Proxy (WAP) servers in a DMZ with defined inbound and outbound ACLs.

The challenge was to restrict the domain controllers' RPC traffic to specific ports, so I only needed to allow a subset of TCP/UDP ports.

The following script needs to run on each domain controller that the DMZ servers can reach. I ran it on Windows Server 2012 R2.

Set TCP ports 55000–55303 for NTDS, Netlogon, NtFrs and RPC

PowerShell14 lines
 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

#Set NTDS RPC port to static setting
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\NTDS\Parameters" -Name "TCP/IP Port" -Value 55000 -PropertyType "DWord"

#Set Netlogon RPC port to static setting
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\Netlogon\Parameters" -Name "DCTcpipPort Port" -Value 55001 -PropertyType "DWord"

#Set NtFrs RPC port to static setting
New-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Services\NtFrs\Parameters" -Name "RPC TCP/IP Port Assignment" -Value 55002 -PropertyType "DWord"

#Set RPC dynamic ports to static range setting
New-Item "HKLM:\Software\Microsoft\RPC\Internet"
New-ItemProperty "HKLM:\Software\Microsoft\RPC\Internet" -Name "Ports" -Value '55003-55303' -PropertyType MultiString -Force
New-ItemProperty "HKLM:\SOFTWARE\Microsoft\Rpc\Internet" -Name "PortsInternetAvailable" -Value Y -PropertyType "String"
New-ItemProperty "HKLM:\SOFTWARE\Microsoft\Rpc\Internet" -Name "UseInternetPorts" -Value Y -PropertyType "String"

After rebooting the domain controllers, I ran gpupdate on my DMZ server to check that AD services were reachable. I then rebooted again and tested a domain logon to check for blocked ports.

References

1 comment

Comments from the original WordPress site, kept read-only.

  1. Matthew Kent

    Line (5) of the powershell script contains an error:

    "DCTcpipPort Port" should read "DCTcpipPort"

    Took me forever to figure out that was wrong....