RDP port 3389

What is the default RDP port?

The default RDP port is 3389. Classic clients use TCP 3389, and current Remote Desktop also uses UDP 3389. Allowing only TCP can make a session feel half broken. The listener is on the Windows server, not on your home PC. The protocol itself, beyond this port, is explained on the RDP definition page.

Read what RDP is when you need the protocol rather than the port. This page keeps the listener, the firewall, and the safer ways to reach it. The machine you administer is a Windows VPS hosting server or an RDP VPS hosting plan when the desktop itself is the product.

Why change the RDP port on a Windows VPS?

Port 3389 is scanned constantly. An open Windows VPS collects password guesses fast, even with a long password. Moving the listener stops bots that only knock on the default. It does not fix a weak password. Keep a path back in, and close 3389 only after the new port has answered a real login.

• Bots try 3389 all day, including on new servers.
• A different port reduces that noise. It does not replace a long password.
• Close 3389 only after you have logged in on the new port.
• Keep the existing session open until that test works.

How do you change the RDP port?

Allow the new TCP port in Windows Firewall, plus UDP if you use current clients, before you touch the listener. Set PortNumber on the RDP-Tcp key, then restart Remote Desktop Services. Leave your current session open. Sign in from a second client on the new port before you delete 3389. If the test fails, undo it from the first session.

3390 below is an example. Pick a free high port and use that number in every step. Add the firewall rule before the registry change.

New-NetFirewallRule -DisplayName "RDP custom" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow
New-NetFirewallRule -DisplayName "RDP custom UDP" -Direction Inbound -Protocol UDP -LocalPort 3390 -Action Allow
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 3390
Restart-Service TermService -Force

1. Stay logged in on the current session.
2. Allow the new TCP port, and UDP if your client uses it.
3. Set PortNumber, then restart Remote Desktop Services.
4. Connect a second client to the IP and the new port.
5. Only then disable the old 3389 rule.

Which firewall rules should match the new RDP port?

Create an inbound allow for your new port on TCP, and on UDP when the client uses it. If your office IP is stable, limit the rule to that address. Keep 3389 until a test login on the new port succeeds, then disable the old rule. Any firewall in front of the VPS must allow the new port too.

If a correct office address was dropped by an older deny rule, unblock an IP address before you decide the new port is broken. The Windows rule and any firewall in front of the VPS both have to allow the port you chose.

• Inbound allow, TCP, and UDP when the client needs it.
• Scope the rule to a stable office IP when you have one.
• Leave 3389 allowed until the new login succeeds.

How do a VPN, an IP allow-list, and NLA make RDP safer?

Changing the port is not access control. Network Level Authentication demands a login before a full desktop loads. An allow-list drops other IPs at the firewall. A VPN is stricter: RDP binds to a private address and the public port stays shut. Prefer those controls when the server holds customer data.

1. Turn on Network Level Authentication so the client authenticates before a full desktop starts.
2. Limit the firewall rule to the addresses that should connect.
3. Prefer a VPN, and bind RDP to the private address, when the server holds customer data.
4. Do not leave an enabled account named Administrator.