MS.Netlogon

Description

This indicates an attempt to use the Netlogon service protocol.
Netlogon is a service that verifies logon requests, registers, and also authenticates and locates domain controllers.

Affected Products

Netlogon

Impact

Firewall Policy Bypass

Technology

Client-Server

Behavior

• Reasonable

Default Ports

• TCP/135
• TCP/139
• TCP/445
• TCP/1024-5000
• TCP/49152-65535
• UDP/137-138
• UDP/445

References

• https://technet.microsoft.com/en-us/library/cc962284.aspx