Is Persistent LSASS.exe Port Usage Normal Between AD and Exchange Servers? (Both on-prem)

Question

Hello,

I would like to request clarification regarding network traffic observed between our Domain Controller and our Exchange server.

In our environment, we are seeing continuous TCP communication where:

Source Server: Active Directory Domain Controller

Destination Server: Microsoft Exchange Server

Process: lsass.exe (Local Security Authority Subsystem Service)

Direction: DC → Exchange

Source Port: remains constant (for example, 49677 or 49671) across many sessions

Destination Port: changes frequently, using high ephemeral RPC ports (dynamic range)

For example, we see multiple established and closed sessions like the following:

AD:49677 → EXCHANGE:30162

AD:49677 → EXCHANGE:30175

AD:49671 → EXCHANGE:24964

However, I would like to confirm that this communication pattern is normal and not indicative of lateral movement, or malicious Activity.

Best regards

Hamza

Answer 1

The observed behavior of continuous TCP communication between your Active Directory Domain Controller and Microsoft Exchange Server, specifically involving the lsass.exe process, can be considered normal under certain circumstances. The lsass.exe process is responsible for enforcing the security policy on the system, handling authentication, and managing user sessions, which includes communication with other servers such as Exchange.

In your case, the constant source port from the Domain Controller and the changing destination ports on the Exchange Server indicate that the Domain Controller is initiating multiple sessions to the Exchange Server, likely for authentication or service requests. This pattern of communication is typical in environments where Exchange relies on Active Directory for user authentication and other directory services.

However, to ensure that this behavior is not indicative of lateral movement or malicious activity, it is important to monitor the nature and frequency of these connections. If the traffic volume is unusually high or if there are other signs of suspicious activity, further investigation may be warranted. Regular monitoring and logging of these sessions can help in identifying any anomalies in the traffic patterns.

In summary, while the communication pattern you described can be normal, maintaining vigilance and monitoring for unusual behavior is essential in any network environment.

---

References:

• Domain controllers can't be located and high-rate outbound sessions
• Service overview and network port requirements for Windows