How to change the RDP port (3389) on Windows Server without locking yourself out

To change the RDP port on Windows Server, allow the new port in Windows Firewall, set the PortNumber value under the RDP-Tcp registry key to the new number and restart Remote Desktop Services. Remote Desktop listens on TCP and UDP port 3389 by default, and because every scanner on the internet knows that number, a Windows server with 3389 open collects thousands of password attempts a day.

Moving RDP to another port is a registry value, two firewall rules and a service restart. It mostly cuts noise. It does not protect a weak password. The order of the steps matters: open the new port first, change the port second, close the old one last. Done the other way round, you lock yourself out.

Which ports move when you change it

• 3389/TCP: the default Remote Desktop listener. This is the number you change.
• 3389/UDP: the UDP transport used alongside TCP. It moves together with the TCP port, so the new port needs a UDP rule as well.
• 443/TCP: Remote Desktop Gateway, which wraps RDP in HTTPS. It is a separate role and is not affected.

Check what the server is using right now:

Get-ItemPropertyValue -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber
Get-NetTCPConnection -LocalPort 3389 -State Listen

3389

LocalAddress LocalPort RemoteAddress RemotePort State  AppliedSetting OwningProcess
------------ --------- ------------- ---------- -----  -------------- -------------
::           3389      ::            0          Listen                1180
0.0.0.0      3389      0.0.0.0       0          Listen                1180

The first line is the configured port, read from the registry. The table shows that Windows really listens on it, over IPv6 and IPv4. If the registry already shows a new number while Windows still listens on 3389, the change was made but the service was never restarted.

Choose a port

Pick something between 1024 and 49151 that nothing else uses: 13389 or 33890 are common choices. Avoid 49152–65535. Windows hands that range out as temporary ports for its own outgoing connections, so your RDP port would compete with them. If neither line prints anything, the port is free for TCP and UDP:

Get-NetTCPConnection -LocalPort 13389 -ErrorAction SilentlyContinue
Get-NetUDPEndpoint -LocalPort 13389 -ErrorAction SilentlyContinue

Change the RDP port step by step

Run every block in PowerShell as Administrator, and replace 13389 with the port you picked.

1. 1Allow the new port in Windows Firewall

   Open the new port first, while the old one still works. Add both TCP and UDP.

   $port = 13389
   New-NetFirewallRule -DisplayName "RDP $port TCP" -Direction Inbound -Protocol TCP -LocalPort $port -Action Allow
   New-NetFirewallRule -DisplayName "RDP $port UDP" -Direction Inbound -Protocol UDP -LocalPort $port -Action Allow

   If your provider or cloud network has its own firewall in front of the server, open the port there as well.

2. 2Set the new port in the registry

   $port = 13389
   $key = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
   Set-ItemProperty -Path $key -Name PortNumber -Value $port
   Get-ItemPropertyValue -Path $key -Name PortNumber

   The last line should print the new port. The block sets $port again on purpose: in a fresh PowerShell window the variable from step 1 is empty, and an empty value here would leave RDP without a usable port.

   Prefer the GUI? Run regedit, go to the key above, double-click PortNumber, switch to Decimal and enter the new number. Leaving it on Hexadecimal is the classic mistake: 13389 in hex is port 78729, which does not exist.

3. 3Restart Remote Desktop Services

   Restart-Service -Name TermService -Force

   Your current RDP window will disconnect. That is expected. -Force is needed because other services depend on TermService. Rebooting the server (Restart-Computer) does the same job.

4. 4Connect on the new port

   Add the port after the address, separated by a colon. Replace 203.0.113.10 with your server’s IP address.

   mstsc /v:203.0.113.10:13389

   xfreerdp3 /v:203.0.113.10:13389 /u:Administrator

   The FreeRDP command is xfreerdp on distributions that still ship FreeRDP 2; the options are the same. On macOS, iOS and Android, enter 203.0.113.10:13389 as the PC name in Microsoft’s Windows App (formerly Microsoft Remote Desktop). Remmina on Linux takes the same notation.

5. 5Close 3389

   Only after the new port works, disable the built-in Remote Desktop rules that allow 3389:

   Disable-NetFirewallRule -DisplayGroup "Remote Desktop"
   
   # non-English Windows: the same group by its resource ID
   Disable-NetFirewallRule -Group "@FirewallAPI.dll,-28752"

Locked out anyway? Open the VNC console, set PortNumber back to 3389, run Enable-NetFirewallRule -DisplayGroup “Remote Desktop” and restart TermService.

Better than a new port: allow only your IP

A changed port still answers anyone who finds it. Restricting the rule to your own address stops password guessing completely. You can list several addresses or whole ranges; replace the examples with your own public IP:

Set-NetFirewallRule -DisplayName "RDP 13389 TCP" -RemoteAddress 198.51.100.7, 192.0.2.0/24
Set-NetFirewallRule -DisplayName "RDP 13389 UDP" -RemoteAddress 198.51.100.7, 192.0.2.0/24

The What is my IP page shows the public IPv4 address the server will see when you connect from home or the office.

Or do not expose RDP at all

The strongest setup has no public RDP port. On Windows Server 2019 and 2022, OpenSSH Server is a built-in optional feature; Windows Server 2025 has it installed already and only needs the service started. Tunnel RDP through SSH and let the firewall block the RDP port from outside:

# Windows Server 2019 and 2022 only; skip this line on Server 2025
Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0

Set-Service -Name sshd -StartupType Automatic
Start-Service sshd

# the setup opens port 22 to everyone; narrow it to your IP like the RDP rules
Set-NetFirewallRule -Name OpenSSH-Server-In-TCP -RemoteAddress 198.51.100.7

ssh -N -L 3390:127.0.0.1:13389 Administrator@203.0.113.10

Leave that running and point the RDP client at localhost:3390. Put your RDP port where 13389 stands (3389 if you never changed it). The local 3390 only has to be free on your own computer, and a Windows PC with Remote Desktop switched on already uses 3389.

A VPN into the server’s network, or an RD Gateway on 443, gets you to the same place. If the server itself needs to use a VPN, read how to use a VPN on a Windows RDP server first: a full-tunnel VPN will cut RDP off.

The rest of the basics

• Keep Network Level Authentication on. It is the default, and it makes clients authenticate before a session is created.
• Use a long, unique password. Bots guess Administrator first, so an admin account with a less obvious name takes it out of the easy list.
• Set an account lockout policy, e.g. net accounts /lockoutthreshold:10 /lockoutwindow:15 /lockoutduration:15.
• Install updates. Several serious RDP vulnerabilities over the years needed no password at all.

It does not connect on the new port

• Is Windows listening? Get-NetTCPConnection -LocalPort 13389 -State Listen should return a line. If not, the registry value or the service restart did not take. If nothing listens on any port, Remote Desktop itself is off: see enabling Remote Desktop on Windows Server.
• Is the port reachable? From your computer, run Test-NetConnection 203.0.113.10 -Port 13389 (Windows) or nc -vz 203.0.113.10 13389 (macOS, Linux). If it fails while Windows is listening, a firewall is in the way, either on the server or upstream at the provider.
• Testing from outside without a second computer? The open port checker opens a TCP connection to the port from our server in Amsterdam. If you limited the rule to your own IP, “no answer” there is the restriction doing its job, not a fault.
• Did you type the port? Without :13389, clients still try 3389. Connecting to RDP shows where each client, the Mac and phone apps included, takes the port.

A Windows RDP VPS from VMHeaven is deployed from a Windows Server template, and the VNC console in the panel means a firewall mistake costs you a few minutes, not the server. Plans run in Amsterdam and Frankfurt: Netherlands RDP has every line in Amsterdam, Germany RDP what Frankfurt has in stock.

Frequently asked