RDP Port 3389: What It Is, How to Change It & How to Secure It

What port does RDP use?

Remote Desktop Protocol listens on port 3389 by default — the IANA-registered port for ms-wbt-server. The main session channel runs over TCP 3389; since RDP 8.0 (Windows 8 and Windows Server 2012) the client also negotiates UDP 3389, which noticeably improves video smoothness and input latency on links with packet loss. The service behind the port is TermService (Remote Desktop Services). If you are new to the protocol itself, our complete RDP guide covers the handshake, encryption and session layers in plain English.

How to check which port RDP is using

From an elevated Command Prompt:

reg query "HKLM\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber

The value is returned in hexadecimal — 0xd3d is 3389. The PowerShell equivalent prints it in decimal directly:

Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber

To confirm something is actually listening:

netstat -ano | findstr :3389

How to change the RDP port

Three steps, in this order — doing the firewall rule before the restart avoids locking yourself out of a remote machine:

1. Set the new port in the registry

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 3390

Pick a port that nothing else uses (above 1024, outside common service ranges).

2. Allow the new port in Windows Firewall

New-NetFirewallRule -DisplayName "RDP custom port TCP" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow
New-NetFirewallRule -DisplayName "RDP custom port UDP" -Direction Inbound -Protocol UDP -LocalPort 3390 -Action Allow

Managing rules by GPO instead? Our guide to Windows Firewall via Group Policy and PowerShell covers the domain-wide version of the same rule.

3. Restart the Remote Desktop service

Restart-Service TermService -Force

Then connect by appending the port to the address in the Remote Desktop client: 203.0.113.10:3390. On a rented Windows VPS, remember the provider-side firewall: the same port must be open at the edge, not just in Windows.

Is changing the port real security?

No — treat it as noise reduction. Internet-wide scanners such as the botnets hammering every public IP will find a moved RDP port in minutes, because the RDP handshake identifies itself on any port. What a custom port genuinely buys you is quieter logs and fewer lockout events from dumb 3389-only bots. The controls that actually stop compromise are:

• Network Level Authentication (NLA) — on by default since Server 2012, keep it on;
• Strong, unique passwords and an account-lockout policy;
• Source-IP restriction in the firewall rule when your client IP is stable;
• A VPN or RD Gateway in front of RDP for anything sensitive.

RDP port vs other remote-access ports

Frequently Asked Questions

Is the RDP port TCP or UDP?

Both — TCP 3389 carries the session, and UDP 3389 (since RDP 8.0) smooths graphics and input.

RDP listens on TCP 3389 for the main session and, since RDP 8.0 (Windows 8 / Server 2012), also uses UDP 3389 for faster graphics and input on lossy links. Open both protocols in your firewall for best performance; only TCP is strictly required.

Can I run RDP on port 443?

It works, but an RD Gateway or a TLS tunnel on 443 is the cleaner approach.

You can set PortNumber to 443 and RDP will work, and the port is rarely blocked by outbound corporate filters. The cleaner approach is an RD Gateway or an SSH/VPN tunnel that carries RDP inside real TLS on 443, so you keep 443 free for web traffic.

Does changing the RDP port stop brute-force attacks?

It only cuts scanner noise — NLA, strong passwords and lockout policies do the real work.

It reduces log noise from bots that only scan 3389, but any full port scan finds RDP in minutes because the protocol handshake identifies itself. Treat a custom port as noise reduction, not protection: keep NLA on, use strong passwords and an account-lockout policy, and restrict source IPs where possible.

What if port 3389 is blocked on my network?

Test with Test-NetConnection, then fall back to an RD Gateway on 443 or a VPN.

Either the server firewall, an ISP filter or a corporate proxy is dropping it. Test with Test-NetConnection server -Port 3389, try UDP off first, then fall back to an RD Gateway on 443 or a VPN. On a rented Windows VPS the provider's edge firewall may also need the port opened.

Want to practice on a machine that is not your own PC? A Windows RDP from rdp.monster comes with full admin access, so you can change ports, firewall rules and services freely — and redeploy in about 10 seconds if you lock yourself out.