What is port 389 used for?
Port 389 is LDAP, the protocol applications use to query and update a directory such as Active Directory: looking up users and groups, checking a password, reading attributes such as a phone number.
A client connects, binds, which is the sign-in step, and then searches or modifies entries. With a simple bind on plain 389 the password crosses the network in clear text. There are two ways to protect it: upgrade the connection with StartTLS on the same port, or connect to 636, where TLS starts immediately. Firewalls between applications and domain controllers need 389 or 636 open, which makes LDAP a frequent culprit when a newly installed application cannot authenticate users.
Is port 389 TCP or UDP?
Mainly TCP. LDAP sessions run over TCP 389. Active Directory also answers a connectionless form over UDP 389, which domain members use to locate a domain controller.
Is LDAP on port 389 encrypted?
Not by default. Either the client issues StartTLS on 389 before binding, or it uses LDAPS on port 636. An application that does a simple bind on plain 389 is sending passwords in clear text.
Port 389 vs port 636: what is the difference?
Port 389 is LDAP, clear text unless upgraded with StartTLS. Port 636 is LDAPS: the same protocol inside TLS from the first byte. The Network+ objectives list both. Port 636 explained
Which CompTIA exams list port 389?
CompTIA lists port 389 by number in both the Network+ and the A+ Core 1 objectives.
- Network+ N10-009: objective 1.4 (Networking Concepts), listed as “Lightweight Directory Access Protocol (LDAP), 389”.
- A+ Core 1 220-1201: objective 2.1 (Networking), listed as “389, Lightweight Directory Access Protocol (LDAP)”.
The quoted text is how the objectives document lists the port. The exam puts the port in a scenario, such as a firewall rule or a failed connection; it does not only ask for the number.
Check yourself: a practice question
Written by CertSprint for this page. It is not taken from any exam.
An application authenticates users against a directory with a simple bind on TCP 389 and no StartTLS. What is the risk?
- Passwords are sent in clear text
- The directory will run out of addresses
- Kerberos tickets expire faster
- DNS zone transfers fail
Show the answer
A. Passwords are sent in clear text. A simple bind sends the password as it is. Without StartTLS or LDAPS, anyone capturing the traffic can read it.
Sources: IANA Service Name and Transport Protocol Port Number Registry: port 389; RFC 4511: Lightweight Directory Access Protocol (LDAP): The Protocol; RFC 4513: LDAP: Authentication Methods and Security Mechanisms; Microsoft Learn: Service overview and network port requirements for Windows. The port number and how each exam lists it come from CompTIA's exam objectives, linked from the study plans above. The explanation and the question are CertSprint's own, checked against these sources on 12 November 2026.