Skip to content
Choose language
العربية Azerbaijani Català 中文 Hrvatski Čeština Dansk Nederlands English Estonian Persian Français Deutsch עברית Magyar Italiano Macedonian Norwegian Português Português Română Русский Español Svenska Türkçe Українська
Get started

Product docsWindows VPS & VDS

Change the Remote Desktop port on Windows Server safely

Move Remote Desktop from port 3389 to a port of your choice without locking yourself out: open the firewall first, change the registry value, restart and test.

  • Intermediate
  • 10 min read
  • Updated
On this page
  1. Before you start
  2. Step 1: Allow the new port in Windows Defender Firewall
  3. Step 2: Change the listening port
  4. Step 3: Restart and test
  5. Step 4: Close the old port
  6. Troubleshooting
  7. Next steps

Remote Desktop listens on TCP and UDP port 3389 by default, and automated bots try that port on every public address all day. Moving it to another port does not replace good security, but it removes most of that noise from your logs. The order of the steps below makes sure you can always get back in.

Before you start

  • Take a snapshot (Windows VPS plans include free snapshots) or make sure you have a backup.
  • Know how to reach the server without Remote Desktop: the console of your service page where your plan offers one; see manage your services.
  • Pick the new port, for example 3390, and check that nothing uses it: Get-NetTCPConnection -LocalPort 3390 should return nothing.
  • Open PowerShell as administrator.

Step 1: Allow the new port in Windows Defender Firewall

Add inbound rules for TCP and UDP before you change the port:

PowerShell
$port = 3390
New-NetFirewallRule -DisplayName "Remote Desktop (TCP $port)" -Direction Inbound -Action Allow -Protocol TCP -LocalPort $port -Profile Any
New-NetFirewallRule -DisplayName "Remote Desktop (UDP $port)" -Direction Inbound -Action Allow -Protocol UDP -LocalPort $port -Profile Any

Microsoft's example creates the rules for the Public profile; -Profile Any covers the profile your network connection uses, whichever it is. To allow only your own addresses, add -RemoteAddress 198.51.100.25 (your IP) to both commands; see Windows Firewall.

Step 2: Change the listening port

Check the current value, then set the new one:

PowerShell
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber'
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value 3390

Step 3: Restart and test

Restart the server so that Remote Desktop listens on the new port:

PowerShell
Restart-Computer

Wait a minute, then connect from your computer with the port after the address:

Text
203.0.113.10:3390

Verify: you can sign in. On the server, Get-NetTCPConnection -LocalPort 3390 -State Listen shows the listener.

Step 4: Close the old port

Once the new port works, disable the built-in Remote Desktop rules that allow port 3389:

PowerShell
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"
Get-NetFirewallRule -DisplayName "Remote Desktop (*" | Format-Table DisplayName, Enabled

Verify: your own rules from Step 1 show Enabled: True, and a new connection on the new port still works. Keep your current session open while you test with a second one.

Troubleshooting

The connection times out after the restart. The firewall rule is missing or uses another profile, or the registry value has a typo. Connect through the console, check Get-ItemProperty from Step 2 and the rules from Step 1. If nothing helps, roll back to your snapshot.

"Remote Desktop can't connect to the remote computer" on the old port. That is expected after Step 4. Connect with address:port.

It works from one network but not from another. You limited the rule with -RemoteAddress, or the other network blocks outgoing traffic to unusual ports (some offices and hotels do). Add the network's address or use a VPN.

More connection problems: see Remote Desktop connection problems.

Next steps

Frequently asked questions

Does a different port make Remote Desktop secure?

It reduces automated scans that only try port 3389, but a port scan finds the new one quickly. Real protection comes from strong passwords, Network Level Authentication, updates and limiting access to your own IP addresses.

Which port should I choose?

An unused port above 1024, for example 3390 or a number in the 49152 to 65535 range. Avoid ports your other software uses, and write the port down where your team can find it.

How do I connect after the change?

Add the port to the address with a colon, for example 203.0.113.10:3390, in Remote Desktop Connection or in the Windows App.

I am locked out after the change. What now?

Use the console of your service page where your plan offers one, or roll back to the snapshot you took before. Otherwise open a ticket; we can help from the console.

Related guides

Generate Password

Please confirm