This has been posted as part of Blaugust 2026, please SYN ACK upon receipt of this post.

A tale from today!

We took over the management of an old hypervisor in a small org a while back. This machine is on its last legs and desperately needs replacing, but due to certain events this keeps getting put off and can kicked and put off again. So, we're stuck keeping this old box running until it dies, at which point I'm sure some money will be found to replace it, because the network will go down entirely. Until then, we just make sure our backups are tried and tested so when the fecal matter inevitably hits the rotary equipment, we can restore things as quickly as possible.

We had an issue after upgrading to the latest version of Veeam where it stopped connecting to the hypervisor in question after working successfully for a few years. It would sit for ages trying to upgrade the servers' Veeam components, then eventually timeout. As with many issues of this kind, the first port of call (heh) is the firewall. A quick check of the firewall logs showed that the Veeam server was trying to connect to the hypervisor on TCP/1544, which is blocked on the firewall. Not a port I had seen Veeam use before. Scanning the used ports documentation doesn't show this port being used, what's going on here?

To connect to the servers, Veaam takes advantage of a range of dynamically assigned ports that are at the top end of the available ports - TCP 49152 to 65535. I didn't know this until today, but earlier versions of Windows Server used a different, smaller range. Anything from port 1025 up to port 5000. The Veeam used ports documentation links to a couple of Microsoft Knowledge Base articles that discuss this but in short, they changed it to the current range of ports in 2008 when MS08-037 came out.

By running netsh int ipv4 show dynamicport tcp Windows will tell you what ports are in that range. Here's the output straight from the horses mouth:

Protocol tcp Dynamic Port Range
---------------------------------
Start Port      : 1025
Number of Ports : 64510

You can adjust this, thankfully. netsh int ipv4 set dynamicport tcp start=49152 num=16383 will set the start port to be 49152. Re-running netsh int ipv4 show dynamicport tcp will now reflect the correct ports, but you may need to restart some services (or the server itself) for the change to kick in across the system.

Thus concludes the tale of the unexpected port that was bloc-wait... wait a sec.

The docs said the initial port range was 1025-5000, but that output said it had 64520 ports in the range. 64510 plus 1025 is... 65535. The top-most port number. Let me check things here, something isn't right.

Okay, I've just checked my documentation. The OS is Server 2016 (yep, End of Life in January, it's barely functioning but we will attempt an upgrade on it in the coming weeks but I do not hold out any hope of it working) and the hardware warranty expired in 2018. We took it over after that but the org it belongs to still hasn't paid out to replace it. So the hardware went out of warranty in 2018, what's the install date of the OS?

By running systeminfo I get a report with a bunch of, well, system info. One line in the output includes the install date: Original Install Date: 14/10/2018, 12:13:26 - yikes, that's a month after the hardware warranty expired. I checked out a few of the dates on the C:\Windows directory and can see dates going back to 2016. The Original Install Date could be when the server was in-place upgraded? I can see some evidence of a sysprep on here but the standard files to check aren't around.

My headcanon for what happened here:

1. A new server is born! Yay! It is purchased by the original owners (either the support company or the org that used it first)
2. Ths server is built with server 2008 (or 2003 I guess?) and the dynamic port range is 1025-5000
3. This server was used in an organisation as an Exchange 2007 server, running Server 2008 - dynamic port range is now 1025-60000 (The docs say Note: When you install Microsoft Exchange Server 2007 on a Windows Server 2008-based computer, the default port range is 1025 through 60000.)
4. This server was purchased from this org, OR ripped out and replaced, by a certain cowboy tech support company
5. The cowboys upgrade-in-place'd this server to 2016 (which perhaps bumped the dynamic port range ceiling up from 60000 to 65535 but maybe didn't bring the floor up with it as it had exchange on it still?)
6. The cowboys THEN cleared off files/programs/Exchange from the previous org
7. It was then configured as a hypervisor (would they have bothered to sysprep and clear out sysprep logs? Maybe I'm wrong about sysprep and they just manually removed stuff)
8. They then finally sold the server to the org that currently owns it as a hypervisor

The server was pretty much the default everything with the firewall off and no real AV when we inherited it. The cowboys that used to manage the tech at this org would absolutely do this. They have a bit of a reputation.

This may be entirely wrong, but either way, this is the kind of stuff I have to work with. I need the stories and theorycrafting to keep me sane. Sigh.