How to change the RDP port from 3389 to another one in Windows Server

If a server is accessible from the internet, the standard port 3389 may be regularly probed by automated scanners. For this reason, system administrators sometimes change the default RDP port, for example from 3389 to 3390, 50000, or another free port.

What is RDP and why does it use port 3389?

RDP stands for Remote Desktop Protocol, a remote desktop protocol developed by Microsoft.

It allows you to connect to a remote computer or Windows Server and work with it almost as if you were sitting right in front of the server.

By default, Remote Desktop uses TCP port 3389.

For example, a standard connection looks like this:

203.0.113.10:3389

If the administrator has changed the port to 3390, you must connect like this:

203.0.113.10:3390

Microsoft documents the ability to change the RDP listening port through the Windows registry or PowerShell.

Why change the standard RDP port?

The main reason is to reduce the amount of automated network noise on the standard port 3389.

Public servers with RDP exposed can regularly receive automated connection attempts and scans. Many automated tools check common ports first, including 3389.

After the port is changed, the server stops accepting RDP connections on the standard 3389 and starts listening for connections on the new port.

Before:

SERVER-IP:3389

After:

SERVER-IP:3390

However, it is important to understand the limitation of this method. Changing the port does not make RDP unreachable for an attacker. If the new port is open to the internet, it can also be discovered by sufficiently broad scanning.

Therefore, changing the RDP port should be treated only as one of several additional elements of overall server security.

Before changing the RDP port

Before you start, make sure you have:

• local administrator rights;
• Remote Desktop enabled;
• access to Windows Server;
• the ability to modify Windows Firewall rules;
• a backup way to access the server.

This is especially important because an incorrect firewall configuration after changing the RDP port can lead to loss of remote access.

Method 1. Changing the RDP port via the Windows registry

One of the standard ways to change the Remote Desktop port is to use the Windows Registry Editor.

Press:

Win + R

Type:

regedit

and press Enter.

Navigate to the following key:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp

Inside the key, find the value:

PortNumber

This is the value that defines the port used by the RDP listener.

By default, its value is usually:

3389

Before making changes, it is advisable to back up the registry key.

Right-click RDP-Tcp, select Export, and save the file.

Then open the PortNumber value. Select Decimal.

Enter the new port, for example:

3390

Click OK.

Method 2. Changing the RDP port via PowerShell

For a system administrator, PowerShell is often a more convenient way to configure Windows Server.

Open PowerShell as administrator.

First, you can check the current RDP port:

Get-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' -Name 'PortNumber'

To change the port to 3390, use:

$portValue = 3390

Set-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' -Name 'PortNumber' -Value $portValue

After changing the value, you need to configure Windows Firewall.

Configuring Windows Firewall for the new RDP port

This is one of the most important steps.

If RDP previously worked on 3389 and now uses 3390, Windows Firewall must allow inbound connections on the new port.

For TCP, create a rule:

New-NetFirewallRule -DisplayName "RDP 3390 TCP" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3390

If necessary, you can also create a rule for UDP:

New-NetFirewallRule -DisplayName "RDP 3390 UDP" -Direction Inbound -Action Allow -Protocol UDP -LocalPort 3390

If you use an external firewall, NAT, security group, or a data center firewall, the new port must be allowed there as well.

Restarting the Remote Desktop Services service

After changing the configuration, you can restart the Remote Desktop Services service:

Restart-Service TermService -Force

If necessary, you can reboot the server:

Restart-Computer

How to check which port RDP is listening on?

After changing the port, you need to verify that Windows is actually listening on the new port.

For example:

netstat -ano | findstr :3390

You can also use PowerShell:

Get-NetTCPConnection -LocalPort 3390 -State Listen

If the configuration is working correctly, the new port should be in the LISTEN state.

How to connect to RDP after changing the port?

Launch the standard Windows Remote Desktop client:

mstsc.exe

In the computer field, enter the IP address and the new port:

203.0.113.10:3390

If you use a domain name:

server.example.com:3390

Windows will establish the RDP connection through the specified port.

How to check the new RDP port from another computer?

From another Windows computer, you can use PowerShell:

Test-NetConnection 203.0.113.10 -Port 3390

If the port is reachable, the result will contain:

TcpTestSucceeded : True

If the result is:

TcpTestSucceeded : False

you need to check Windows Firewall, the external firewall, NAT, routing, and the state of the Remote Desktop service.

What to do if RDP stopped working?

If the connection is lost after changing the port, check the configuration step by step.

1. Check PortNumber

Make sure that in the registry:

HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp

the PortNumber value contains the correct number.

2. Check Windows Firewall

Make sure the new TCP port is allowed for inbound connections.

3. Check the RDP listener state

netstat -ano | findstr :3390

4. Check the connection from outside

Test-NetConnection SERVER-IP -Port 3390

5. Check the external firewall and NAT

If the server is located in a data center or behind NAT, you need to check the network rules outside of Windows Server.

6. Check the Remote Desktop Services service

Get-Service TermService

The service must be in the Running state.

Which port should you choose for RDP?

There is no universal "best" non-standard RDP port.

You can choose a free port that is not used by another service and is permitted by your network policy.

For example:

• 3390;
• 3391;
• 50000;
• 55000.

However, a high or non-standard port number by itself does not provide full protection.

Before choosing a port, make sure it is not used by another application.

netstat -ano

Is changing the RDP port secure?

No. Changing the RDP port by itself does not make a server secure.

If the new port is open to the entire internet, it can also be discovered by scanning.

Therefore, it is recommended to use multiple layers of protection:

• Network Level Authentication (NLA);
• Windows Firewall;
• strong unique passwords;
• regular Windows updates;
• IP-based access restrictions;
• VPN;
• Remote Desktop Gateway;
• MFA, if supported by your infrastructure.

Recommended RDP protection scheme

For a Windows Server accessible over the internet, it is recommended to use several independent protection mechanisms.

1. Install the latest Windows updates.
2. Use complex unique passwords.
3. Enable Network Level Authentication.
4. Change the standard RDP port if necessary.
5. Allow the new port only in the necessary firewalls.
6. Where possible, restrict connections to trusted IP addresses.
7. Use a VPN or Remote Desktop Gateway for remote access.
8. Monitor authentication logs and suspicious connections.
9. Use MFA wherever possible.

Example of a complete RDP setup on port 3390

Suppose the Windows Server uses the public IP address:

203.0.113.10

We want to change the RDP port:

3389 → 3390

Change the port:

$portValue = 3390

Set-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' -Name 'PortNumber' -Value $portValue

Open the port in Windows Firewall:

New-NetFirewallRule -DisplayName "RDP 3390 TCP" -Direction Inbound -Action Allow -Protocol TCP -LocalPort 3390

Restart the service:

Restart-Service TermService -Force

Check the listener:

Get-NetTCPConnection -LocalPort 3390 -State Listen

Check availability from another computer:

Test-NetConnection 203.0.113.10 -Port 3390

After a successful check, connect:

203.0.113.10:3390

Conclusion

You can change the standard Windows Server RDP port from 3389 to another port using the registry editor or PowerShell.

It is important to remember the three main steps:

1. change the PortNumber value;
2. allow the new port in Windows Firewall;
3. verify the connection through the new port.

Changing the standard RDP port can reduce the number of automated requests to 3389, but it is not full protection.

For a public Windows Server, you should additionally use NLA, a firewall, IP restrictions, strong authentication, security updates, and, where possible, a VPN or Remote Desktop Gateway.

Before changing the settings of a remote server, make sure you have a backup way to access it. This will allow you to regain control of the server in case of an RDP or firewall configuration error.