Common Ports for Windows Services — TCP/UDP Reference

Core Windows Service Ports

Microsoft 365 and Exchange Ports

Checking Open Ports with netstat

To see which ports are currently listening on the local machine, use netstat from an elevated Command Prompt or PowerShell:

rem Show all listening TCP ports with owning process IDs
netstat -ano | findstr LISTENING

rem Show all active connections and listening ports (TCP and UDP)
netstat -ano

rem Resolve PIDs to process names (run in PowerShell)
netstat -ano | Select-String LISTENING

To cross-reference a PID with a process name:

rem Replace 1234 with the PID from netstat output
tasklist /fi "PID eq 1234"

Checking Remote Port Connectivity with Test-NetConnection

Test-NetConnection is the PowerShell replacement for telnet and is built into Windows 8.1 and Server 2012 R2+. It confirms whether a remote TCP port is reachable from the current machine:

# Test if RDP port is reachable on a remote server
Test-NetConnection -ComputerName SRV-DC01 -Port 3389

# Test SMB
Test-NetConnection -ComputerName FILESERVER01 -Port 445

# Test LDAP on a Domain Controller
Test-NetConnection -ComputerName SRV-DC01 -Port 389

# Test SQL Server
Test-NetConnection -ComputerName SRV-SQL01 -Port 1433

# Test HTTPS connectivity to Exchange Online
Test-NetConnection -ComputerName smtp.office365.com -Port 587

A successful result shows TcpTestSucceeded : True. A failure shows False — this means either the service is not listening, a firewall is blocking the port, or a network route does not exist between the two machines.

For a quick port sweep against a server to map which services are responding:

$server = "SRV-DC01"
$ports = @(53, 88, 135, 389, 445, 464, 636, 3268, 3269, 3389)

foreach ($port in $ports) {
    $result = Test-NetConnection -ComputerName $server -Port $port -WarningAction SilentlyContinue
    [PSCustomObject]@{
        Port   = $port
        Result = if ($result.TcpTestSucceeded) { "OPEN" } else { "CLOSED/FILTERED" }
    }
} | Format-Table -AutoSize

Checking What's Listening on a Specific Port

To identify which process is using a port on the local machine — useful for diagnosing port conflicts:

# Find what's listening on port 443 (replace 443 with any port)
$port = 443
$connection = Get-NetTCPConnection -LocalPort $port -State Listen -ErrorAction SilentlyContinue

if ($connection) {
    $pid = $connection.OwningProcess
    Get-Process -Id $pid | Select-Object Id, ProcessName, Path
} else {
    Write-Host "Nothing listening on port $port" -ForegroundColor Yellow
}

Restricting RPC Dynamic Ports via Registry

For environments where firewall rules must cover RPC traffic without opening the full 49152–65535 range, you can restrict RPC to a narrower dynamic port range. This requires a registry edit and a reboot:

rem Set RPC dynamic port range to 50000-51000 (adjust as needed, minimum 255 ports)
reg add "HKLM\SOFTWARE\Microsoft\Rpc\Internet" /v Ports /t REG_MULTI_SZ /d "50000-51000" /f
reg add "HKLM\SOFTWARE\Microsoft\Rpc\Internet" /v PortsInternetAvailable /t REG_SZ /d Y /f
reg add "HKLM\SOFTWARE\Microsoft\Rpc\Internet" /v UseInternetPorts /t REG_SZ /d Y /f

After applying the registry change, the corresponding firewall rule must allow TCP inbound on the same restricted range on servers that receive RPC connections (Domain Controllers, file servers, print servers).

Need Help?

Melbits manages IT infrastructure and network security for Melbourne businesses. If you need a firewall audit, Active Directory port review, or help configuring network segmentation to reduce your attack surface, contact us. We design and document Windows network environments that are both functional and secure.