Go Up
You are here: DeploymentAppendixProtocols and Ports Required for Netwrix AuditorWindows Server

Protocols and Ports Required for Monitoring Windows Server

Review a full list of protocols and ports required for Netwrix Auditor for Windows Server.

  • Allow outbound connections from the dynamic (1024 - 65535) local port on the computer where Netwrix Auditor Server resides.
  • Allow outbound connections to remote ports on the source and inbound connections to local ports on the target.

Tip for reading the table: For example, on the computer where Netwrix Auditor Server resides (source), allow outbound connections to remote 139 TCP port. On monitored computers (target), allow inbound connections to local 139 TCP port.

Port Protocol Source Target Purpose

139

445

TCP

Netwrix Auditor Server

Monitored computer

Service Control Manager Remote Protocol (RPC)

Remote registry

135

+ Dynamic:

1024 -65535

TCP

Netwrix Auditor Server

Monitored computer

Windows Management Instrumentation

Collect objects

135

+ Dynamic:

1024 -65535

TCP

Netwrix Auditor Server

Monitored computer

Collect removable storage insertions. Allow the following process to use the port: %systemroot%\system32\plasrv.exe

135 and 137 through 139

TCP

Netwrix Auditor Server

Monitored computer

Service Control Manager Remote Protocol (RPC)

Core Service installation

445

TCP

Netwrix Auditor Server

Monitored computer

SMB 2.0/3.0

9011

TCP

Computers where Netwrix Auditor for Windows Server Compression Services reside

Netwrix Auditor Server

Network traffic compression and interaction with services

Go Up