Passwordstate Documentation

Open Port Considerations ​

To ensure the Password Reset Portal functions correctly, there are various ports which need to be open on your network for both the Password Reset Portal website itself, but also for your Passwordstate webserver so it can communicate with Active Directory Domains, and Event Logs on Domain Controllers as well. Below is a summary of these ports.

Password Reset Portal Ports ​

Your users will need to connect to your Password Reset Portal (PRP) website, which is installed using Port 443. This will present them to the page to begin the process of resetting or unlocking their own Active Directory password/account.

Passwordstate Web Site Ports ​

The Password Reset Portal (PRP) needs to communicate back to your Passwordstate API, so generally Port443 is required to be open on your Passwordstate webserver. If you are using a different port for your Passwordstate website, then this port will instead need to be open

Domain Ports ​

  • Port 636 - this is required if using LDAP over SSL (LDAPS), so the Passwordstate UI and API can communicate with Active Directory to reset and unlock accounts
  • Port 88 and 464 is required if using Kerberos, so the Passwordstate UI and API can communicate with Active Directory to reset and unlock accounts
  • To query Event Logs on Domain Controllers for account lockouts, Port 135 needs to be open, and also the existing Windows Firewall rule "Remote Event Log Management (RPC)", which uses dynamic ports

If you are unsure if the ports above are open, or if you believe you are having some issues because of blocked ports, you can use the following PowerShell command examples (using contoso.com as the domain)

Powershell
Test-NetConnection contoso.com -Port 636
Test-NetConnection contoso.com -Port 88
Test-NetConnection contoso.com -Port 464
Test-NetConnection contoso.com -Port 135
Test-NetConnection contoso.com -Port 49153

Testing the Password Reset Portal port is open (using dmz01.contoso.com as the server’s name which is hosting the PRP)

Powershell
Test-NetConnection dmz01.contoso.com -Port 443