Since I haven't seen posts, it's TCP 135+something up in the ephemeral range. 135 is the manager, which opens a second port you talk to. That second port is where netlogon happens is my understanding.

We have some 2008r2 hosts that are in the process of shutting down I had to gulag off.