464

Port 464/tcp is registered with IANA as kpasswd with the description "kpasswd," assignee/contact Greg Hudson (MIT Kerberos), a modification date of 2023-11-17, and a blank reference field (dual-registered on TCP and UDP; nmap lists the service as "kpasswd5"). It lets a principal change its own password, or an administrator set another principal's password, over a port dedicated separately from the KDC, since Kerberos authentication itself runs on port 88. The protocol is specified in RFC 3244 (February 2002), "Microsoft Windows 2000 Kerberos Change Password and Set Password Protocols" by M. Swift, J. Trostle, and J. Brezak — an Informational RFC documenting Microsoft's protocol, which became the de-facto standard via Active Directory; it accepts requests on both UDP and TCP port 464 as a single request message followed by a single reply, and it interoperates with the original MIT/Heimdal kpasswd. The IANA reference field is blank. The current relevance is that port 464, on both TCP and UDP, is live on every Active Directory domain controller, part of the AD/Kerberos port cluster alongside 88 (kerberos), 389/636 (LDAP/LDAPS), 445 (SMB), and 3268/3269 (Global Catalog), with Microsoft's AD port-requirements documentation listing it for Kerberos password change toward the PDC Emulator. Security-wise this is itself a security mechanism, its presence is a strong fingerprint of a KDC or AD domain controller, and concerns are general — password-policy bypass, brute force or credential stuffing, lockout-based denial of service, and man-in-the-middle on weak configurations — so it should be internal-only and never exposed to the public internet. For an analyst, an open 464 (especially alongside 88, 389, and 445) effectively identifies an Active Directory domain controller or KDC, and it belongs only on internal networks.

IANA assignment

kpasswd — "kpasswd"; reference (blank — no RFC cited in IANA registry); assignee Greg Hudson (MIT Kerberos); modification date 2023-11-17; dual-registered 464/tcp + 464/udp [IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

well-known (0–1023)

Prevalence

common in enterprise scans due to AD ubiquity; nmap-services open-frequency ~0.001192 (de-facto) [Well-established] — nmap-services file

Related ports

88 (kerberos), 389/636 (LDAP/LDAPS), 445 (SMB), 3268/3269 (Global Catalog) — the AD cluster

Primary use

Kerberos change/set password (RFC 3244), on a dedicated port separate from the KDC (88)

Other/unofficial uses

none meaningful (nmap service name "kpasswd5") [Well-established]

Security implications

a security mechanism (password change); presence fingerprints a KDC/AD DC; general risks (policy bypass, brute force, lockout DoS, MITM on weak configs); internal-only [Well-established]

Typically seen on

Active Directory domain controllers; MIT/Heimdal KDCs

Analyst note

An open 464 (especially with 88/389/445) effectively identifies an Active Directory domain controller / KDC; it belongs only on internal networks.

Port 464/udp carries kpasswd, the Kerberos v5 change-password and set-password service; it should stay internal-only rather than reach the public internet. IANA registers it as kpasswd with a blank Reference column, assignee Greg Hudson (MIT Kerberos maintainer), a registry modification date of 2023-11-17, and dual-registration alongside 464/tcp.

The protocol is documented in RFC 3244 (M. Swift, J. Trostle, J. Brezak; February 2002), "Microsoft Windows 2000 Kerberos Change Password and Set Password Protocols," an Informational RFC that formalized Microsoft's implementation and later became the de-facto standard adopted by MIT Kerberos and Heimdal. A client sends a single request and the server replies once, letting a principal change its own password or, with sufficient privilege, reset another principal's password without needing the old one.

In practice 464/udp runs on Active Directory domain controllers and MIT/Heimdal KDCs, usually opened together with 464/tcp since clients may fall back to TCP for larger payloads. Its presence alongside 88 (Kerberos), 389/636 (LDAP/LDAPS), and 445 (SMB) is a reliable fingerprint of a domain controller or KDC host.

Measured prevalence favors UDP over TCP for this service: the repo's nmap-services-derived port-data records an open-frequency of about 0.0043 (0.43%) for 464/udp versus about 0.001192 (0.12%) for 464/tcp, consistent with UDP being the default first-choice transport for the kpasswd exchange.

IANA assignment

kpasswd — "kpasswd"; reference (blank — no RFC cited in IANA registry); assignee [Greg_Hudson_2] (MIT Kerberos maintainer); modification date 2023-11-17; dual-registered 464/tcp + 464/udp [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry kpasswd 464/udp

Range class

well-known/system (0–1023) [Confirmed] — the IANA Service Name and Transport Protocol Port Number Registry kpasswd 464/udp

Prevalence

nmap-services open-frequency 464/udp ~0.0043 (0.43%); 464/tcp ~0.001192 (0.12%) [Confirmed] — this site's own tooling (kpasswd5 rows)

Related ports

88 (kerberos), 389/636 (LDAP/LDAPS), 445 (SMB), 3268/3269 (Global Catalog), 464/tcp (paired transport) — the AD/Kerberos cluster [Well-established]

Primary use

Kerberos v5 change/set-password protocol (RFC 3244), run on a port dedicated separately from the KDC (88)

Other/unofficial uses

none meaningful; nmap service name kpasswd5

Security implications

core Kerberos/AD mechanism; internal-only; presence fingerprints a KDC/AD domain controller; general risks of policy bypass, brute force, and lockout DoS; no documented malware association as of August 2026

Typically seen on

Active Directory domain controllers; MIT Kerberos (kadmind); Heimdal Kerberos (kpasswdd) [Likely] — https://github.com/H3r1CH/penetration-testing/blob/main/pentesting-network/464-kpasswd.md, https://www.oreilly.com/library/view/kerberos-the-definitive/0596004036/ch06s05s01.html

Analyst note

An externally reachable 464/udp, especially with 88/389/445, effectively identifies an Active Directory domain controller or KDC; it belongs only on internal/trusted networks.