Windows server firewall blocking active directory authentication?

Question

I'm having problems with authenticating macs on our windows 2003 server domain. When windows firewall is activated, mac clients(10.4) can no longer login. I've tried opening a number of ports e.g.TCP/UDP 53. UDP 464. but no luck. Any ideas which ports are necessary for the AD plugin to work properly?
Thanks.
macpro   Mac OS X (10.4.8)   1gb ram

Answer 1

Why are you enabling Windows firewall on a domain controller?
My recommendation is to turn it off and protect your entire site with a hardware firewall. The ports you need to open up are the very ones you should be blocking from the world to prevent attacks.
Short of that:
http://www.microsoft.com/downloads/details.aspx?FamilyID=c2ef3846-43f0-4caf-9767 -a9166368434e&displaylang=en
User Login and Authentication
A user network logon across a firewall uses the following:
• Microsoft-DS traffic (445/tcp, 445/udp)
• Kerberos authentication protocol (88/tcp, 88/udp)
• Lightweight Directory Access Protocol (LDAP) ping (389/udp)
• Domain Name System (DNS) (53/tcp, 53/udp)
Computer Login and Authentication
A computer logon to a domain controller uses the following:
• Microsoft-DS traffic (445/tcp, 445/udp)
• Kerberos authentication protocol (88/tcp, 88/udp)
• LDAP ping (389/udp)
• DNS (53/tcp, 53/udp)
Access File Resource
File access uses SMB over IP (445/tcp, 445/udp).
Perform a DNS Lookup
To perform a DNS lookup across a firewall ports 53/tcp and 53/udp must be open. DNS is used for name resolution and supports other services such as the domain controller locator
...