# Change the Remote Desktop port on Windows Server safely

> Move Remote Desktop from port 3389 to a port of your choice without locking yourself out: open the firewall first, change the registry value, restart and test.

Difficulty: Intermediate

Remote Desktop listens on TCP and UDP port **3389** by default, and automated bots try that port on every public address all day. Moving it to another port does not replace good security, but it removes most of that noise from your logs. The order of the steps below makes sure you can always get back in.

## Before you start

- **Take a snapshot** (Windows VPS plans include free snapshots) or make sure you have a backup.
- Know how to reach the server without Remote Desktop: the console of your service page where your plan offers one; see [manage your services](/guides/manage-your-services).
- Pick the new port, for example `3390`, and check that nothing uses it: `Get-NetTCPConnection -LocalPort 3390` should return nothing.
- Open PowerShell as administrator.

## Step 1: Allow the new port in Windows Defender Firewall

Add inbound rules for TCP and UDP **before** you change the port:

```powershell
$port = 3390
New-NetFirewallRule -DisplayName "Remote Desktop (TCP $port)" -Direction Inbound -Action Allow -Protocol TCP -LocalPort $port -Profile Any
New-NetFirewallRule -DisplayName "Remote Desktop (UDP $port)" -Direction Inbound -Action Allow -Protocol UDP -LocalPort $port -Profile Any
```

Microsoft's example creates the rules for the **Public** profile; `-Profile Any` covers the profile your network connection uses, whichever it is. To allow only your own addresses, add `-RemoteAddress 198.51.100.25` (your IP) to both commands; see [Windows Firewall](/guides/windows-firewall).

## Step 2: Change the listening port

Check the current value, then set the new one:

```powershell
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber'
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value 3390
```

## Step 3: Restart and test

Restart the server so that Remote Desktop listens on the new port:

```powershell
Restart-Computer
```

Wait a minute, then connect from your computer with the port after the address:

```text
203.0.113.10:3390
```

**Verify:** you can sign in. On the server, `Get-NetTCPConnection -LocalPort 3390 -State Listen` shows the listener.

## Step 4: Close the old port

Once the new port works, disable the built-in Remote Desktop rules that allow port 3389:

```powershell
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"
Get-NetFirewallRule -DisplayName "Remote Desktop (*" | Format-Table DisplayName, Enabled
```

**Verify:** your own rules from Step 1 show `Enabled: True`, and a new connection on the new port still works. Keep your current session open while you test with a second one.

## Troubleshooting

**The connection times out after the restart.** The firewall rule is missing or uses another profile, or the registry value has a typo. Connect through the console, check `Get-ItemProperty` from Step 2 and the rules from Step 1. If nothing helps, roll back to your snapshot.

**"Remote Desktop can't connect to the remote computer" on the old port.** That is expected after Step 4. Connect with `address:port`.

**It works from one network but not from another.** You limited the rule with `-RemoteAddress`, or the other network blocks outgoing traffic to unusual ports (some offices and hotels do). Add the network's address or use a VPN.

**More connection problems:** see [Remote Desktop connection problems](/guides/rdp-connection-problems).

## Next steps

- Go further than a port change: [secure a new Windows Server](/guides/secure-windows-server).
- Give colleagues their own login: [Remote Desktop users and sessions](/guides/windows-remote-desktop-users).

## Frequently asked questions

### Does a different port make Remote Desktop secure?

It reduces automated scans that only try port 3389, but a port scan finds the new one quickly. Real protection comes from strong passwords, Network Level Authentication, updates and limiting access to your own IP addresses.

### Which port should I choose?

An unused port above 1024, for example 3390 or a number in the 49152 to 65535 range. Avoid ports your other software uses, and write the port down where your team can find it.

### How do I connect after the change?

Add the port to the address with a colon, for example 203.0.113.10:3390, in Remote Desktop Connection or in the Windows App.

### I am locked out after the change. What now?

Use the console of your service page where your plan offers one, or roll back to the snapshot you took before. Otherwise open a ticket; we can help from the console.

---

Source: <https://hyperdc.com/guides/products/change-rdp-port>\
Updated: 2026-10-15