Hello, One question about citrix wem and ldap connection. the service account needs to read the root domain's ad. Does it use port 389 or 636?

Depends if you are using Ldap or ldap(s).