Home / server / Questions / 4769
Accepted
pbz
Asked: 2009-05-06 07:14:51 +0800 CST

Port 135 / epmap

  • 772

I'm looking at securing a web server (Windows Server 2008). A GRC port scan recommended that I close down port 135 (https://www.grc.com/port_135.htm). However, I've done this before with Windows Server 2003 and after doing this I wasn't able to RDP to the box.

Why is port 135 needed for RDP (port 3389) and since I don't have physical access to the box should port 135 be blocked (if so what about RDP)?

Thanks.

windows-server-2008 security port

3 Answers

  1. Best Answer

    The RPC Endpoint Mapper (port 135) is definitely not required by RDP, and it is perfectly reasonable (and suggested) to block it on a firewall so non local hosts cannot attempt to enumerate and exploit services.

    I only say this with certainty because I have many hosts configured like this, and actually just tested it to make sure I wasn't crazy ;-)

    • 4

  2. Yes! Close that port!

    Done it? Whew...

    Don't expose that port to the outside. Not a good idea. You'll be fine with just the RDP port open. Yes, I have empirically tested this with a server running RDP. Note that there are some DoS attacks against unpatched RDP servers, so be sure to get up-to-date.

    • 2

  3. I think because parts of Terminal Services use it:

    TCP Port 135 - RPC Terminal Services Licensing

    TCP Port 135 - RPC Terminal Services Session Directory

    So when you connect via 3389 - the server wants to see how your TS is licensed, etc so it uses TCP/135 to call your DC or wherever your TS Licensing is kept.

    This article can help

    http://support.microsoft.com/kb/908472/en-us

    • 2