RDP port 3389: how to change the Remote Desktop port on Windows Server

The default RDP port is TCP 3389. Current Windows versions also listen on UDP 3389 for a faster transport and fall back to TCP when UDP is blocked. Because every scanner on the internet knows that number, a Windows server with 3389 open collects thousands of password attempts a day.

Moving RDP to another port is a registry value, two firewall rules and a service restart. It mostly cuts noise. It does not protect a weak password. The order of the steps matters: open the new port first, change the port second, close the old one last. Done the other way round, you lock yourself out.

RDP ports at a glance

• 3389/TCP — the default Remote Desktop listener.
• 3389/UDP — the UDP transport used alongside TCP. It moves together with the TCP port.
• 443/TCP — Remote Desktop Gateway, which wraps RDP in HTTPS.

Check what the server is using right now (PowerShell as Administrator):

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber
Get-NetTCPConnection -LocalPort 3389 -State Listen

Choose a port

Pick something between 1024 and 49151 that nothing else uses — 13389 or 33890 are common choices. Avoid 49152–65535. Windows hands that range out as temporary ports for its own outgoing connections, so your RDP port would compete with them. If this prints nothing, the port is free:

Get-NetTCPConnection -LocalPort 13389 -ErrorAction SilentlyContinue

Change the RDP port step by step

1. 1Allow the new port in Windows Firewall

   Open the new port first, while the old one still works. Add both TCP and UDP.

   $port = 13389
   New-NetFirewallRule -DisplayName "RDP $port TCP" -Direction Inbound -Protocol TCP -LocalPort $port -Action Allow
   New-NetFirewallRule -DisplayName "RDP $port UDP" -Direction Inbound -Protocol UDP -LocalPort $port -Action Allow

   If your provider or cloud network has its own firewall in front of the server, open the port there as well.

2. 2Set the new port in the registry

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value $port

   Prefer the GUI? Run regedit, go to the key above, double-click PortNumber, switch to Decimal and enter the new number. Leaving it on Hexadecimal is the classic mistake — 13389 in hex is port 78729, which does not exist.

3. 3Restart Remote Desktop Services

   Restart-Service -Name TermService -Force

   Your current RDP window will disconnect. That is expected. Rebooting the server (Restart-Computer) does the same job.

4. 4Connect on the new port

   Add the port after the address, separated by a colon:

   # Windows
   mstsc /v:203.0.113.10:13389
   
   # Linux (FreeRDP; the binary is xfreerdp3 on newer distributions)
   xfreerdp /v:203.0.113.10:13389 /u:Administrator

   On macOS, iOS and Android, enter 203.0.113.10:13389 as the PC name in Microsoft’s Windows App (formerly Microsoft Remote Desktop). Remmina on Linux takes the same notation.

5. 5Close 3389

   Only after the new port works, disable the built-in Remote Desktop rules that allow 3389:

   Disable-NetFirewallRule -DisplayGroup "Remote Desktop"
   
   # non-English Windows: the same group by its resource ID
   Disable-NetFirewallRule -Group "@FirewallAPI.dll,-28752"

Locked out anyway? Open the VNC console, set PortNumber back to 3389, run Enable-NetFirewallRule -DisplayGroup “Remote Desktop” and restart TermService.

Better than a new port: allow only your IP

A changed port still answers anyone who finds it. Restricting the rule to your own address stops password guessing completely. You can list several addresses or whole ranges:

Set-NetFirewallRule -DisplayName "RDP 13389 TCP" -RemoteAddress 198.51.100.7, 192.0.2.0/24
Set-NetFirewallRule -DisplayName "RDP 13389 UDP" -RemoteAddress 198.51.100.7, 192.0.2.0/24

Or do not expose RDP at all

The strongest setup has no public RDP port. On Windows Server 2019 and newer, OpenSSH Server is a built-in optional feature. Tunnel RDP through SSH and let the firewall block the RDP port from outside:

Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0
Set-Service -Name sshd -StartupType Automatic
Start-Service sshd

ssh -N -L 13389:127.0.0.1:3389 [email protected]
# then point the RDP client at localhost:13389

A VPN into the server’s network, or an RD Gateway on 443, gets you to the same place. If the server itself needs to use a VPN, read how to use a VPN on a Windows RDP server first — a full-tunnel VPN will cut RDP off.

The rest of the basics

• Keep Network Level Authentication on. It is the default, and it makes clients authenticate before a session is created.
• Use a long, unique password. Bots guess Administrator first, so an admin account with a less obvious name takes it out of the easy list.
• Set an account lockout policy, e.g. net accounts /lockoutthreshold:10 /lockoutwindow:15 /lockoutduration:15.
• Install updates. Several serious RDP vulnerabilities over the years needed no password at all.

It does not connect on the new port

• Is Windows listening? Get-NetTCPConnection -LocalPort 13389 -State Listen should return a line. If not, the registry value or the service restart did not take.
• Is the port reachable? From your computer, run Test-NetConnection 203.0.113.10 -Port 13389 (Windows) or nc -vz 203.0.113.10 13389 (macOS, Linux). If it fails while Windows is listening, a firewall is in the way — on the server, or upstream at the provider.
• Did you type the port? Without :13389, clients still try 3389.

VMHeaven KVM plans can be deployed from a Windows Server template, and the VNC console in the panel means a firewall mistake costs you a few minutes, not the server.

Frequently asked