SQL Server – Frequently used ports

This list is about essential TCP/UDP port numbers that an administrator running SQL Server / Cluster requires to know when configuring the firewall or otherwise.
It includes those used under OS, server-based programs & their subcomponents. Certainly do let me know for any corrections that I may have missed out.

Frequently Used Ports

ServiceTypePort#Comments
Default InstanceTCP1433Official socket allocated by IANA to Ms for SQL Server, this can be changed to anything above 1024.
Named InstanceTCPxxxxxAs & what you assign in the dynamic port range. There have been changes since Win 6, see below for the available range.
DAC Default InstanceTCP1434Remote connections through DAC are disabled unless turned on manually. For named instance ports other than 1434 are used.
SQL Browser / SQL Server Resolution ProtocolUDP1434Used by an application level protocol SSRP on top of which the browser service runs.It helps when connecting to non-hidden instances named instances. In such cases TCP port is dynamic (unless specified) & determined when the Database Engine starts. It’s not needed if all connections contain the port#. When uninstalling SQL 9.0 from a machine running SQL 8.0 check the existence of registry key IsListenerActive, because if it exists SSRP will fail to listen.Denali Browser does not support sending information about SQL 8.0 instances.Refer à http://msdn.microsoft.com/en-us/library/cc219750(v=PROT.10).aspx
MULTICASTUDP Allows multicast response on UDP (Browser Service Enumerations)
DTS / SSIS 3882Be cautious a malformed request to port 3882/tcp can cause DOS. When communicating with remote SSIS port 135 is used & if it’s a SSIS package is running against a database server you need 1433 or as specified. Uses msdts1 protocol for service type msdts1.
SSASTCP2393, 2394, 2725OLAP Services 7.0 used TCP ports 2393 & 2394. Though Ms has reserved UDP ports 2393 & 2394 those are not used by OLAP Services. Analysis Services uses TCP port 2725. For backward compatibility, Analysis Services uses TCP ports 2393 & 2394 when connected with an OLAP Services 7.0 client.
SSASTCP2383Standard port for the default instance of Analysis Services. User configurable;
Browser SSASTCP2382Client connection requests for a named instance of Analysis Services that do not specify a port number are directed to SQL Server Browser.
RDPTCP3389Providing the remote desktop to a client or VDI keep your eyes open because the default encryption certificate (RSA pk stored in mstlsapi.dll), is there with widows base install. A Man-in-the-Middle (MITM) attack can intercept the exchange of RDP encryption information. Check here for safety ribbons secure RDP using Transport Layer Security http://technet.microsoft.com/en-us/library/cc782610%28WS.10%29.aspx  For 6.0 Network Level Authentication offers much stronger protection http://blogs.technet.com/askperf/archive/2008/02/16/ws2008-network-level-authentication-and-encryption.aspx 
Dynamic Port RangeTo comply with Internet Assigned Numbers Authority recommendations, Ms has increased the dynamic client port range for outgoing connections. Since the release of Win 6.0 new default port range is 49152 – 65535 which was earlier 1025 through 5000.
Service BrokerTCP User configurable; there is no default port. BOL conventional configuration uses TCP 4022.
SSLTCP443When used with HTTP forming HTTPS, it provides an encrypted communication channel.
HTTP endpoint  Used when connecting through a url, this is user configurable; this can be customized while creating an endpoint. Port 80 for CLEAR_PORT traffic & 443 for SSL_PORT traffic.
HTTPS endpointTCP443Default instance running over an HTTPS endpoint, used for a connection through url which used SSL.
iSCSI 3260, 860 
SQL Agent File Copy135Agent to copy backup files to the shared folder on the standby server.  
137, 138, 139, 445File copy on UNC shares.
SQL DebuggerTCP135Exception for IPsec traffic might also require you to set an inbound rule for 500 & 4500 if IPsec is used for network communication.After opening port 135 include the applications Visual Studio à Devenv.exe / Management Studio à ssms.exe.
Database Mirroring  User configurable; there is no default port. While setting multiple instances be cautious to not to break the quorum. BOL conventional configuration uses TCP 7022.
ReplicationTCP1433For push transactional replication a working 1433 between distributor & subscriber is all you need, however in pull subscriptions few other ports are needed; when you launch an initialization of a subscriber SQL uses the windows default port 445 for mapped drives to copy down scripts.FTP (21) can be used initially to transfer schema & data over the internet; it can also use HTTP (80) or File & Print Sharing (ports 137,138, 139).You can put merge replication to use WEB synchronization using port 80 or encrypted 443. Replication uses the IIS endpoint, when syncing over HTTP (80 by default but configurable), however IIS process connects to SQL Server through standard ports. Keep in mind when synchronizing over the Web using FTP, there is no transfer between subscriber & IIS, it’s all amid IIS & the publisher.
Cluster ServiceUDP3343Cluster services control & manage the cluster database. Like the Heartbeat process – Cluster network driver (Clusnet.sys) performs intra-node communication between each node of the cluster by periodically exchanging sequenced, unicast/multicast UDP datagrams in the cluster. This determines whether all nodes are running correctly & network links are healthy. Generally this does not happens over the public network.There are cases when the range of random available IP ports that the cluster service uses to initiate communication through RPCs is less than 100 ports & connection to the Cluster Admin fails (refer to 154596  (http://support.microsoft.com/kb/154596/ ) ).RPC – 135 / Cluster Network Drv – 3343 / SMB – 445 / NetBIOS – 139 / RPC 5000-5099 / 8011-8031·  135 (RPC endpoint mapper/DCOM), (RPC endpoint mapper over UDP).·  For nodes running multiple services, ports 5000-5099 (or more) may be needed for remote RPC connectivity. If closed, error 1721 might occur when you connect to a remote cluster.
             Cluster service requires at least 100 ports for communication through RPC. Count of ports available may get too low when other services like DNS, WINS, Ms SQL Server service & others are using some of the necessary ports.·  Ports 8011-8031 must be open for internode RPC connectivity or the cluster log will indicate that a SPONSOR is not available. Again these errors occur because there are not enough ports available for RPC communication between a node trying to join the cluster & a node that can sponsor the new node.
Cluster AdminUDP137
Random PortsUDPCheck dynamic port range
RPCTCP135
Filestream  139 & 445.
SSISTCP135DCOM
WMITCP135Used by SSCM, it runs over DCOM (aka Network OLE) when accessing remote data. After initial connection DCOM randomly assigns a port for further communication where some tools may require a TCP port > 1024 (aka TCP high port) opened on the remote host.
IPsec trafficUDP500 & 4500Should be set to allow ISAKMP traffic to be forwarded for both inbound & outbound filters.
MsDTC RPCSince NT 4,  MSDTC has been performing as the transaction coordinator for components with COM  .NET  architectures. Connected resources can be databases, message queues or file systems which may be distributed. Messages are sent on TCP 135 while the responses are on a dynamically assigned port.

How do you clone SQL permissions from one account to another using dbatools

When a new hire or existing user needs access to a database or multiple databases. Easiest way is to figure out if there is any existing user whose permissions can be cloned and applied to the new user.

Instructions

The following step works if DBAUtility database is already setup and you are running SQL agent job to capture a snapshot of all user permissions across the entire SQL instance.

USE DBAUtility
EXEC perms.clonePermissions @UserName = N'Domain\user1',      -- nvarchar(256)
                            @NewUser = N'Domain\user2',       -- nvarchar(256)
                            @logintype = 'U',      -- char(1)
                            @CreateLogins = 1, -- bit
                            @ExecuteScript = 1-- bit

How to run native SQL backups across multiple servers and multiple databases

Follow the below process to run SQL backups across one or more SQL servers, one or more databases using a simple powershell command. This uses the dbatools, open source powershell modules. You would use this in a scenario when Commvault server is down.

Instructions

Run the backups using the following powershell script:

$servers = 'SQLSERVER01','SQLSERVER02'
$filepath = '\\NetworkPath\Backup\servername\dbname'
$dbnamelist = 'DB01','DB02'
foreach ($server in $servers)
{
Backup-DbaDatabase -SqlInstance $server -database $dbnamelist -BackupDirectory $filepath -Type Full -CompressBackup -ReplaceInName -BuildPath
}

In the example above, the script would backup databases named ‘DB01′ and ‘DB02’ on both servers listed in the $servers variable. In order to backup all the databases, remove the -database parameter.

Creating Directories Dynamically

In the previous examples we just wrote the backups to the root of a file share. But sometimes you’ll want to organize or separate your backups based off of server name or database name or backup type. This is something else that dbatools makes very simple to do dynamically. This is done by using the –ReplaceInName parameter and then specifying keywords in your FilePath and Path strings.

-ReplaceInName
If this switch is set, the following list of strings will be replaced in the FilePath and Path strings:
instancename – will be replaced with the instance Name
servername – will be replaced with the server name
dbname – will be replaced with the database name
timestamp – will be replaced with the timestamp (either the default, or the format provided)
backuptype – will be replaced with Full, Log or Differential as appropriate

The backup jobs have already been created for certain critical servers which will enable us to switch to an alternative way to keep running backups in case Commvault server goes down.

Run the below script to enable the backup jobs across multiple servers:

# Run the following to enable native SQL backups to a network path
#Backup Location = '\\NetworkPath\Backup\servername\dbname'
$servers = 'SQLSERVER01','SQLSERVER02','SQLSERVER03'
foreach($server in $servers)
{
Set-DbaAgentJob -SqlInstance $server -Job 'DatabaseBackup - SYSTEM_DATABASES - FULL', 'DatabaseBackup - USER_DATABASES - DIFF', 'DatabaseBackup - USER_DATABASES - FULL' -Enabled
}

# Run the following to enable transaction log backups for selected servers
Set-DbaAgentJob -SqlInstance SQLSERVER01 -Job 'DatabaseBackup - SYSTEM_DATABASES - LOG' -Enabled

 Run the below script to disable the backup jobs across multiple servers:

# Run the following to disable native SQL backups 
$servers = 'SQLSERVER01','SQLSERVER02','SQLSERVER03'
foreach($server in $servers)
{
Set-DbaAgentJob -SqlInstance $server -Job 'DatabaseBackup - SYSTEM_DATABASES - FULL', 'DatabaseBackup - USER_DATABASES - DIFF', 'DatabaseBackup - USER_DATABASES - FULL' -Disabled
}
# Run the following to disable transaction log backups on selected servers
Set-DbaAgentJob -SqlInstance SQLSERVER01 -Job 'DatabaseBackup - SYSTEM_DATABASES - LOG' -Disabled

Install SQL Server maintenance solution

This script will download and install the latest version of SQL Server Maintenance Solution created by Ola Hallengren

Install-DbaMaintenanceSolution -sqlinstance SQLSERVER01 -database master -BackupLocation "\\NetworkPath\Backup\SQLSERVER01" -InstallJobs  -CleanupTime 168

What do the parameters mean?

ParameterDescriptionExample
sqlinstanceServer NameSQLSERVER01
databaseDatabase Name (Defaults to master if none specified)master
BackupLocationPath where backups will be stored (defaults to native SQL path specified in the instance
InstallJobsThis switch will create the SQL agent jobsThis only works when you install the full solution
CleanupTimeHow many hours worth of backups should be retained

Following script will remove the unwanted SQL agent jobs created by the maintenance solution.

We delete the below four jobs since we handle the requirement through different jobs

Remove-DbaAgentJob -SqlInstance SQLSERVER01 -Job 'sp_purge_jobhistory' -Mode Lazy
Remove-DbaAgentJob -SqlInstance SQLSERVER01 -Job 'sp_delete_backuphistory' -Mode Lazy
Remove-DbaAgentJob -SqlInstance SQLSERVER01 -Job 'CommandLog Cleanup' -Mode Lazy 
Remove-DbaAgentJob -SqlInstance SQLSERVER01 -Job 'Output File Cleanup' -Mode Lazy 

Highlight important information in a panel like this one. To edit this panel’s color or style, select one of the options in the menu below.

Install dbatools powershell module

In order to execute the first time, PackageManagement requires an internet connection to download the Nuget package provider. However, if your computer does not have an internet connection and you need to use the Nuget or PowerShellGet provider, you can download them on another computer and copy them to your target computer. Use the following steps to do this:

  • Open PowerShell (as Admin)
  • Run the following to set powershell to TLS 1.2:
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 -Force

If you run Windows 10 or Windows Server 2016, you’ve already got support for the Gallery and can just issue the following command. This will download the package, unzip it into C:\temp\dbatools folder. Temp folder must exist for this to work. If temp folder does not exist, please create one before running the below script

Save-Module -Name dbatools -Path C:\temp

Keep in mind that the DLLs will likely be blocked by default. If this happens, simply run

Get-ChildItem -Recurse C:\temp | Unblock-File

Copy the dbatools folder from C:\temp to C:\Program Files\WindowsPowerShell\Modules folder

Open PS or command prompt and run the below command: $env:PSMODULEPATH

Any module placed within your $env:PSMODULEPATH will automatically load once you execute a command from the module

Run the following command to test the import of dbatools PS module:

Import-Module dbatools

It should run without any errors. You are now free to proceed to run any of the dbatools PS modules for DBA administrative tasks.