DCE RPC Inspection and Active Directory Services

[avilt]

If I enable dce/rpc inspection, can I have active directory over firewalls without allowing dynamic ports?

I have 2012 R2 domain controllers in firewall segment and AD clients in a different subnet. 

[Dennis Mink]

here is an older post on it.

https://supportforums.cisco.com/t5/security-documents/dcerpc-inspection-on-asa-pix-fwsm/ta-p/3126387

so theoretically it works. but packet inspection is not always a silver bullet