Change Default RDP Port for Security: A Complete Guide

Remote Desktop Protocol (RDP) is a crucial tool in Windows environments, allowing administrators and users to remotely access servers and desktops. By default, RDP uses TCP port 3389 for communication. While this default configuration is convenient, it is also widely known and frequently targeted by attackers. Changing the RDP port to a non-standard value can add an extra layer of security through obscurity, reducing the chances of automated attacks and brute-force login attempts.

This article provides a step-by-step guide on how to change the default RDP port in Windows, explains why it matters, and shares best practices for securing RDP connections.

1. Why Change the Default RDP Port?

Leaving RDP on its default port (3389) exposes the system to several risks:

• Automated Attacks: Hackers and bots constantly scan the internet for open port 3389.

• Brute-Force Attempts: Attackers try thousands of username/password combinations against RDP.

• Denial of Service (DoS): The default port is a common target for overwhelming attack traffic.

• Compliance Requirements: Some organizations require changing default ports as part of their security policy.

While changing the RDP port is not a standalone security measure, it is an effective way to reduce exposure and complement other controls like firewalls, VPNs, and MFA.

2. Considerations Before Changing the Port

Before you proceed:

• Document the New Port: If forgotten, you may lock yourself out.

• Firewall Rules: The new port must be allowed through firewalls.

• Router/NAT Settings: If accessing externally, port forwarding needs adjustment.

• Group Policies: Centralized policies may need updating.

• Monitoring Tools: Update monitoring/alert systems to track the new port.

3. Steps to Change the Default RDP Port in Windows

The process involves editing the Windows Registry and configuring firewall rules.

Step 1: Backup Registry

1. Press Windows + R, type regedit, and press Enter.

2. In Registry Editor, click File → Export.

3. Save the registry backup in case you need to restore settings.

Step 2: Navigate to RDP Port Registry Key

Go to:

HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Step 3: Modify the Port Number

1. In the right pane, locate the key PortNumber.

2. Double-click it and select Decimal.

3. Enter a new port number (e.g., 3390, 50000).

   • Recommended range: 1025 – 65535 (avoid well-known ports).

Step 4: Update Firewall Rules

1. Open Windows Defender Firewall with Advanced Security.

2. Navigate to Inbound Rules → Remote Desktop (TCP-In).

3. Edit the rule to allow traffic on your new port.

4. Alternatively, create a new inbound rule specifically for the new port.

Step 5: Update Router/NAT (if external access required)

• Log into your router/firewall.

• Modify port forwarding rules to map the new external port to the internal server IP and port.

Step 6: Restart the System

• Restart Windows Server or workstation for the change to take effect.

4. Connecting to RDP on the New Port

Once configured, clients must specify the new port when connecting:

• Open Remote Desktop Connection (mstsc).

• Enter the server name or IP followed by a colon and port number:

  192.168.1.100:50000
  

• Click Connect and log in as usual.

5. Verifying the New Port Configuration

To confirm RDP is listening on the new port:

1. Open Command Prompt as Administrator.

2. Run:

   netstat -an | find "LISTENING"
   

3. Look for the new port in the output (e.g., 0.0.0.0:50000).

Alternatively, use tools like Nmap from another machine:

nmap -p 50000 <server-ip>

6. Security Best Practices Alongside Port Change

Changing the port is only one step. Combine it with these measures for stronger protection:

6.1 Use Strong Authentication

• Enforce complex passwords.

• Implement Multi-Factor Authentication (MFA) for RDP sessions.

6.2 Restrict Access

• Use firewall rules to allow only trusted IP ranges.

• Consider a VPN so RDP is accessible only through secure tunnels.

6.3 Enable Network Level Authentication (NLA)

• Require NLA so credentials are validated before establishing a session.

6.4 Use RDP Gateway

• Deploy an RD Gateway to centralize and encrypt remote access.

6.5 Regular Patching

• Keep Windows and RDP components updated against vulnerabilities.

6.6 Monitor Logs

• Review Event Viewer → Security and Terminal Services logs.

• Watch for suspicious login attempts.

7. Advantages of Changing the RDP Port

• Reduced Noise: Fewer brute-force attempts from automated bots scanning port 3389.

• Improved Stealth: Makes it harder for attackers to find your RDP service.

• Custom Security: Helps comply with organizational security policies.

8. Limitations of Port Change

• Not Foolproof: Port scanning tools can still find the service.

• Compatibility Issues: Some monitoring or management tools expect the default port.

• Administrative Overhead: Requires updating firewall, documentation, and connection settings.

Thus, port change should be viewed as one layer in a defense-in-depth strategy, not a standalone solution.

9. Troubleshooting Common Issues

• Cannot Connect After Port Change:

  • Ensure firewall rules include the new port.

  • Check NAT/router forwarding configuration.

  • Confirm RDP service is running.

• Forgotten Port:

  • Access the server console directly.

  • Restore from registry backup.

• Conflicting Port:

  • Make sure the new port is not already in use (netstat -an).

10. Conclusion

Change Default RDP Port for Security Changing the default RDP port from 3389 to a custom value is a simple yet effective way to reduce exposure to automated attacks and brute-force attempts. While it does not replace core security measures such as MFA, VPNs, firewalls, and patching, it adds a valuable layer of protection.

By following the steps outlined—modifying the registry, updating firewall rules, and configuring client connections—you can successfully secure your RDP environment. Combined with best practices like restricting access and monitoring logs, this approach strengthens the overall security of your Windows systems.