You can enable
Windows Firewall on your domain controllers for enhanced security, but you should
add below mention exceptions. Otherwise client machine not able to join to your
domain.
Enable the File And Print Sharing exception.
Enable program exceptions for lsass.exe
Enable program exceptions for ntfrs.exe
(which are found under
%windir%\system32)
Enable below mention ports
53 (TCP and UDP)
88 (TCP and UDP)
123 (UDP), 135 (TCP)
137 (TCP), 389 (UDP)
464 (TCP and UDP)
636 (TCP).