How to Use This Cheat Sheet
This quick reference gathers the commands, ports, and default values that come up constantly in day-to-day Windows Server and AD administration, organized so you can scan for the right tool without re-deriving syntax from scratch mid-incident. It complements the deeper PowerShell for AD Administration and Monitoring and Event Logs topics — use this page for fast lookups and those for the reasoning behind why each tool or setting matters.
Cricket analogy: A quick reference sheet is like a fielding captain's laminated card of field placements for different bowlers — you don't re-derive the strategy mid-over, you glance and execute.
Essential Ports and Protocols
Active Directory relies on a specific set of ports that must be open between domain controllers and clients across firewalls: LDAP (389/TCP+UDP), LDAPS (636/TCP), Global Catalog (3268/TCP, 3269/TCP for SSL), Kerberos (88/TCP+UDP), DNS (53/TCP+UDP), SMB (445/TCP), and RPC Endpoint Mapper (135/TCP) plus a dynamic high port range for RPC that can be restricted to a fixed range via registry settings for firewall predictability. When replication or authentication mysteriously fails only across a site link or through a firewall, checking this exact port list with Test-NetConnection is almost always the fastest diagnostic first step.
Cricket analogy: The fixed set of required ports is like the exact list of equipment a stadium must have ready before a match — stumps, bails, specific ball type — miss one and the game literally cannot proceed correctly.
# Test key AD ports from a client to a domain controller
'389','636','3268','3269','88','53','445','135' | ForEach-Object {
Test-NetConnection -ComputerName dc01.corp.contoso.com -Port $_ |
Select-Object ComputerName, RemotePort, TcpTestSucceeded
}
# Quick health check trio used constantly during incidents
dcdiag /q
repadmin /replsummary
nltest /dsgetdc:corp.contoso.comDefault Values and Common Cmdlets Cheat Sheet
Key defaults worth memorizing: tombstone lifetime is 180 days on domains created before Windows Server 2003 SP1 and 60 days on newer forests, default account lockout threshold is disabled unless configured by policy, Kerberos clock skew tolerance is 5 minutes, and the default Group Policy refresh interval is 90 minutes with a randomized offset of up to 30 minutes. For everyday cmdlet recall: Get-ADUser/-Group/-Computer for reads, Set-* for updates, dsa.msc for the ADUC GUI, gpupdate /force to push policy immediately, and Get-ADReplicationFailure to surface replication problems without parsing raw event logs.
Cricket analogy: Memorizing these defaults is like a captain knowing the exact over-rate penalty thresholds and DRS review count without needing to look them up mid-match — routine numbers you just know cold.
Get-ADReplicationFailure -Target (Get-ADDomainController -Filter *).Name summarizes replication failures across every DC in one call, which is often faster during an incident than manually parsing Directory Service event logs DC by DC.
The default Group Policy refresh interval (90 minutes ± up to 30 minutes) means a policy change is not instant. Do not assume a GPO 'didn't work' if you check within minutes of applying it — either wait for the natural refresh window or run gpupdate /force on the target machine to confirm the change actually failed versus just not yet applied.
- Essential AD ports: LDAP 389, LDAPS 636, Global Catalog 3268/3269, Kerberos 88, DNS 53, SMB 445, RPC 135 plus dynamic range.
- Test-NetConnection against this exact port list is the fastest first diagnostic step for cross-firewall or cross-site failures.
- Tombstone lifetime defaults to 60 days on modern forests (180 days on pre-2003 SP1 domains) and governs backup and restore validity.
- Kerberos clock skew tolerance defaults to 5 minutes; Group Policy refresh defaults to 90 minutes plus up to a 30-minute random offset.
- Core cmdlet families to recall instantly: Get-AD*/Set-AD* for reads/writes, gpupdate /force for immediate policy push.
- dcdiag, repadmin /replsummary, and nltest /dsgetdc form the standard first-response health check trio during incidents.
- Get-ADReplicationFailure summarizes replication issues across all DCs in one call, faster than parsing raw event logs manually.
Practice what you learned
1. Which port is used for standard unencrypted LDAP traffic to a domain controller?
2. What is the default Group Policy background refresh interval on domain member computers?
3. Which cmdlet quickly summarizes replication failures across all domain controllers in one call?
4. What is the default tombstone lifetime on a modern Active Directory forest?
5. Which command immediately forces a Group Policy refresh instead of waiting for the default interval?
Was this page helpful?
You May Also Like
Windows Server & AD Interview Questions
A curated set of commonly asked Windows Server and Active Directory interview questions with clear, technically grounded answers.
PowerShell for AD Administration
Learn how to manage users, groups, and organizational units in Active Directory using the ActiveDirectory PowerShell module, bulk pipelines, and remoting.
Monitoring and Event Logs
Learn how Windows Event Logs, Event Viewer, and key security event IDs help administrators detect AD problems and security incidents.
Related Reading
Related Study Notes in Microsoft Technologies
Browse all study notesWindows 10 / UWP Development Study Notes
.NET · 30 topics
Microsoft TechnologiesWindows Batch Scripting Study Notes
Batch · 30 topics
Microsoft TechnologiesMFC (Microsoft Foundation Classes) Study Notes
C++ · 30 topics
Microsoft TechnologiesSilverlight Study Notes
.NET · 30 topics
Microsoft TechnologiesXAML Study Notes
.NET · 30 topics
Microsoft TechnologiesWPF (Windows Presentation Foundation) Study Notes
.NET · 30 topics