Every now and then, I need to provide or verify firewall the configuration required for domain authentication to occur across a firewall boundary. Here’s a very useful KB article that enumerates the requirements. The wide RPC range is usually problematic, but we’ve implemented the RPC port reallocation according to KB 154596 . That makes it a little cleaner.