In this article:
Objective
Prerequisites
Steps to follow
Validation and confirmation
Tips
Related topics and articles
Objective
This article explains how to configure and manage the ports used by ADAudit Plus for web access, data collection, and communication with domain controllers and other components. Understanding these port requirements is essential for setting up firewall or network rules during installation or integration with Active Directory, file servers, workstations, and member servers. Proper configuration ensures seamless data flow, agent communication, and interface access, while misconfigured ports can cause audit failures, incomplete reports, or service inaccessibility.
Prerequisites
ADAudit Plus must be installed and accessible on your internal network.
Be using a supported OS: Windows Server 2008 R2 and above.
Admin privileges might be required on both the ADAudit Plus server and the target server or workstation to update firewall rules or ports.
Steps to follow
Refer to the table below for all essential ports used by ADAudit Plus:
Port | Protocol | Used For |
8081 (default) | HTTP | ADAudit Plus web client access |
8444 | HTTPS | ADAudit Plus web client access (secure) |
33307 | TCP | Database port |
29118 | TCP | DataEngine (indexing engine) port |
9270 | HTTP | To connect to the Elasticsearch database (when the AD Backup and Recovery add-on is enabled) |
9370 | TCP | Used for communication between nodes in a cluster (when the AD Backup and Recovery add-on is enabled) |
389 | TCP/UDP | LDAP (directory access) |
636 | TCP | Secure LDAP (LDAPS) |
3268 | TCP | Global Catalog (LDAP GC) |
3269 | TCP | Global Catalog (Secure LDAP GC) |
88 | TCP/UDP | Kerberos authentication |
135 | TCP | For Windows log collection Source: ADAudit Plus server Destination: Monitored computers |
139 | TCP | NetBIOS Session Service Source: ADAudit Plus server Destination: Monitored computers |
25 | SMTP | To send emails Source: ADAudit Plus server Destination: SMTP server |
465 | SMTP | To send emails Source: ADAudit Plus server Destination: SMTP server |
587 | SMTP | To send emails Source: ADAudit Plus server Destination: SMTP server |
445 | TCP | SMB RPC or named pipes (NP) Source: ADAudit Plus server Destination: Monitored computers |
137, 138 | UDP | NetBIOS name resolution and NetBIOS name resolution RPC or named pipes (NP) Source: ADAudit Plus server Destination: Monitored computers |
514 (Needed if you are monitoring Synology, EMC Islon etc..) | UDP | Syslog reception Source: Your NAS device, i.e., Synology Destination: ADAudit Plus server |
49152–65535 | TCP | Dynamic RPC ports for WMI or DCOM communication |
Open the necessary ports on the ADAudit Plus server .
Use Windows Firewall or a third-party firewall to allow inbound traffic on ports such as 8081, 389, or 445.
If using secure LDAP, ensure port 636 is open.
Allow TCP 135 and dynamic ports 49152–65535 for WMI auditing.
3. Open the necessary ports on domain controllers and audited servers
Enable similar rules to allow incoming requests from ADAudit Plus.
Ensure WMI and RPC traffic is permitted for file and member server auditing.
4. Modify the web client port (if needed)
Open the ADAudit Plus UI > Admin > Connection to change the ADAudit Plus port.
You can update the desired port under HTTP and HTTPS from 8081 and 8444 to your desired ports.
Restart ADAudit Plus for the change to take effect.
Also, you can go to ADAuditPlus\logs\wrapper.log to see ADAudit Plus' current port. (Scroll down the notepad and you will find the tag, i.e., Connect to: https://localhost:8444)
Validation and confirmation
Access ADAudit Plus from a web browser using http://<hostname>:8081 or 8444 (if HTTPS is enabled) or your custom port.
Use the Troubleshooter in ADAudit Plus to verify connectivity and port status.
Tips
Use firewall policies to restrict access to ADAudit Plus to trusted IP ranges.
Use LDAPS (port 636) over LDAP for encrypted directory queries.
Document and monitor all changes to network port rules.
Avoid using commonly exploited ports unless necessary and ensure those ports are secured.
Related topics and articles