В Windows для подключения к рабочему столу удаленного компьютера по протоколу RDP (Remote Desktop) по-умолчанию используется порт TCP 3389. В этой статье мы рассмотрим, как изменить номер стандартного порта для службы RDP на другой (применимо как к дестопным версиям Windows, так и к Windows Server).
Содержание:
- Изменить номер RDP порта в Windows
- PowerShell скрипт для смены номера RDP порта в Windows
После того, как вы включили RDP доступ в Windows, служба TermService (Remote Desktop Services) начинает слушать на порту 3389.
В современных версиях Windows для подключений удаленного рабочего стола также используется протокол UDP с тем же номером порта 3389. При использовании VPN, транспортный UDP протокол может вызывать проблемы с зависанием RDP сессий.
Для чего может понадобиться замена стандартного RDP порта 3389 на другой?
- Чаще всего это используется, чтобы спрятать RDP/RDS хост от автоматических сканеров портов, которые ищут в Интернете хосты Windows с открытым дефолтным RDP портом 3389.
- Смена RDP порта позволит уменьшить вероятность эксплуатации RDP уязвимостей, уменьшить количество попыток удалённого подбора паролей по RDP (не забывайте периодически анализировать логи RDP подключений), SYN и других типов атак.
- Обычно смена RDP порт используется на компьютерах с прямым подключением к интернету (VPS/VDS), или в сетях, где пограничный маршрутизатор перенаправляет порт 3389/RDP в локальную сеть на компьютер/сервер с Windows.
Несмотря на смену порта, не рекомендуется выставлять открытый RDP порт в Интернет. Сканеры портов по сигнатуре ответа могут понять, что на новом порту находится RDP Listener. Если вы хотите открыть внешний RDP доступ к компьютеру в локальной сети, лучше использовать такие технологии подключения, как VPN, RD Web Access, шлюз RD Gateway и другие.
При смене номера RDP порта на нестандартный, нежелательно использовать номера портов в диапазоне от 1 до 1023 (известные порты). Выберите неиспользуемый порт в пользовательском диапазоне (1024 до 49151) или из RPC (49152 — 65535). Проверьте, что выбранный порт не слушается другими процессами (например, порт 1350).
netstat -aon | findstr ":1350" | findstr "LISTENING"
Изменить номер RDP порта в Windows
В нашем примере мы изменим номер порта, на котором ожидает подключения служба TermService на 1350.
Для быстрой замены номера RDP порта на указанный, достаточно выполнить следующие команды с правами администратора:
set p=1350
reg add "HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" /v PortNumber /t REG_DWORD /d %p% /f
netsh advfirewall firewall add rule name="Custom-RDP-Port-TCP" protocol=TCP localport=%p% action=allow dir=IN
netsh advfirewall firewall add rule name="Custom-UDP-Port-UDP" protocol=UDP localport=%p% action=allow dir=IN
net stop TermService /y
net start TermService
Этот набор команд изменит номер RDP порта, создаст разрешающие правила для нового порта в файерволе и перезапустит службу TermService.
Рассмотрим, что делают эти команды и как изменить дефолтный номер RDP порта вручную.
- Откройте редактор реестра (
regedit.exe
) и перейдите в ветку HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp - Найдите DWORD параметр реестра с именем PortNumber. В этом параметре указан порт, на котором ожидает подключения служба Remote Desktop. Значение по умолчанию 3389 (decimal)
- Измените значение этого порта. Я изменил RDP порт на 1350 в десятичном значении (Decimal);
хalert] Можно изменить значение параметра реестра с помощью PowerShell:
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\" -Name PortNumber -Value 1350
[/alert] - Создайте новые правила в Windows Firewall, разрешающие входящие подключения на новый номер RDP порта (если вы перенастраиваете удаленный сервер через RDP, создайте разрешающее правило в файерволе до перезапуска службы TermService, иначе вы потеряете доступ к хосту). Вы можете создать разрешающее входящее правило для нового TCP/UDP порта RDP вручную из консоли Windows Firewall with Advanced Security (
wf.msc
) или с помощью PowerShell команд:
New-NetFirewallRule -DisplayName "NewRDPPort-TCP-In" -Direction Inbound -LocalPort 1350 -Protocol TCP -Action allow
New-NetFirewallRule -DisplayName "NewRDPPort-UDP-In" -Direction Inbound -LocalPort 1350 -Protocol UDP -Action allow
- Перезагрузите Windows или перезапустите службу удаленных рабочих столов командой:
net stop termservice & net start termservice
- Теперь для подключения к данному Windows компьютеру по RDP, в клиенте mstsc.exe нужно указывать порт RDP подключения через двоеточие следующим образом:
Your_Computer_Name:1350
или по IP адресу
192.168.1.100:1350
или из командной строки:
mstsc.exe /v 192.168.1.100:1350
Если для управления RDP подключений вы используете менеджер RDCMan, новый номер RDP порта подключения указывается на вкладке “Connection Settings”.
- В результате вы должны успешно подключитесь к рабочему столу удаленного компьютера по новому номеру RDP порта (с помощью команды
netstat –na | Find "LIST"
убедитесь, что служба RDP теперь слушает на другом порту).
Обратите внимание, что номер UDP порта RDP также изменился на 1350 (проще всего проверить это с помощью утилиты TCPView).
С помощью команды Test-NetConnection, проверьте что старый RDP порт теперь закрыт (
TcpTestSucceeded : False
):
Test-NetConnection 192.168.13.202 -port 3389 |select TcpTestSucceeded
Если вы хотите изменить номер RDP порта сразу на нескольких компьютерах в домене, можно воспользоваться групповыми политиками. Создайте новую GPO, которая распространит параметр реестра PortNumber с новым значением RDP порта на компьютеры домена.
PowerShell скрипт для смены номера RDP порта в Windows
Полный код PowerShell скрипта для смены номера RDP порта, создания правила в брандмауэре и перезапуска службы RDP может выглядеть так:
Write-host "Укажите номер нового RDP порта: " -ForegroundColor Yellow -NoNewline;$RDPPort = Read-Host
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-TCP\" -Name PortNumber -Value $RDPPort
New-NetFirewallRule -DisplayName "NewRDPPort-TCP-In-$RDPPort" -Direction Inbound –LocalPort $RDPPort -Protocol TCP -Action Allow
New-NetFirewallRule -DisplayName "NewRDPPort-UDP-In-$RDPPort" -Direction Inbound –LocalPort $RDPPort -Protocol UDP -Action Allow
Restart-Service termservice -force
Write-host "Номер RDP порта изменен на $RDPPort " -ForegroundColor Magenta
Если на удаленном компьютере включен WinRM, вы можно изменить номер порта RDP удаленно с помощью командлета Invoke-Command:
Invoke-Command -ComputerName PC1name -ScriptBlock {Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-TCP\" -Name PortNumber -Value 1350}
Remote Desktop Protocol (RDP) is a widely used protocol developed by Microsoft to allow remote access to computers and servers. By default, RDP uses port 3389, but there are several reasons why you might want to change this port or use alternative ports. In this blog post, we will explore what ports can I use for RDP, the reasons for modifying the default port, and how to do so safely.
Default RDP Port: 3389
Port 3389 is the official and default port for RDP connections. When you connect to a remote machine using RDP, the client communicates with the remote server over TCP and UDP using this port. While it is convenient to use the default port, it also presents security risks, as cyber attackers frequently target it for brute-force attacks, exploits, and unauthorized access attempts.
Why Change the Default RDP Port?
1. Enhanced Security
One of the primary reasons for changing the default RDP port is security. Attackers often scan networks for open port 3389, looking for vulnerable systems. Changing the RDP port makes it harder for attackers to find your system, adding a layer of security by obscurity.
2. Compliance with Network Policies
Some organizations or ISPs block traffic on port 3389 for security reasons. In such cases, changing the port may be necessary to comply with network policies and enable remote access without violating security protocols.
3. Avoiding Port Conflicts
If multiple devices on a network require RDP access, and port forwarding is in use, changing the port allows different machines to be accessible remotely without interfering with each other.
4. Preventing Automated Attacks
Many automated bots and malware scripts are programmed to target port 3389. Changing the port can reduce the risk of automated attacks and unauthorized access attempts.
Alternative Ports for RDP
Although port 3389 is the standard, you can configure RDP to use other ports. Here are some considerations when selecting an alternative port:
1. Choosing a Non-Standard Port
When selecting an alternative port, consider using a port number above 1024 (e.g., between 1025 and 65535) to avoid conflicts with well-known ports. Examples of alternative ports include:
- 5000 – Often used for various services but can be repurposed for RDP.
- 6001 – Used in some networking applications but can be used for RDP.
- 12345 – A commonly chosen high-range port for custom applications.
- 40000-50000 – Less commonly used, reducing the risk of conflicts and automated attacks.
2. Using Custom Ports
When choosing a custom port, ensure that it does not conflict with other critical services. Check your system’s network usage to confirm that the chosen port is available and not being used by another application.
How to Change the RDP Port on Windows
If you decide to use an alternative port for RDP, follow these steps to modify the RDP port in Windows:
Step 1: Modify the Windows Registry
- Press Win + R, type regedit, & hit Enter to open the Windows Registry Editor.
- Navigate to the following key:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
- Locate the PortNumber entry.
- Right-click PortNumber, select Modify, choose Decimal, and enter your new port number (e.g., 5000).
- Click OK and close the Registry Editor.
Step 2: Configure Windows Firewall
To allow traffic on the new port:
- Open the Windows Defender Firewall.
- Click Advanced Settings.
- Select Inbound Rules > New Rule.
- Choose Port and click Next.
- Select TCP, enter the new port number, and click Next.
- Choose Allow the connection, then select the network profiles (Domain, Private, Public).
- Name the rule (e.g., “Customs RDP Port”) & click Finish.
Step 3: Restart the Remote Desktop Services
To apply the changes:
- Open Command Prompt as an administrator.
- Run the following command to restart the RDP service:
net stop termservice && net start termservice
- Restart your computer for changes to take effect.
Step 4: Update Router Port Forwarding (If Necessary)
If you’re accessing the RDP session over the internet, update the port forwarding settings on your router:
- Log in to your router’s web interface.
- Navigate to Port Forwarding.
- Create a new rule forwarding your chosen port to the local IP address of the RDP server.
- Save and apply the changes.
Testing the New RDP Port
To test whether RDP is using the new port, use the following command in Command Prompt:
netstat -an | find "LISTENING" | find "5000"
Replace 5000 with your chosen port number. If the output shows that the port is listening, RDP is now configured on the new port.
Security Considerations When Changing RDP Ports
1. Enable Network Level Authentication (NLA)
To enhance security, enable Network Level Authentication (NLA) by going to:
- Control Panel > System and Security > System.
- Click Remote Settings.
- Under Remote Desktop Protocol, select “Permit connections only from computers running Remote Desktop with Network Level Authentication.”
2. Use a VPN for Remote Access
Rather than exposing RDP directly to the internet, consider using a VPN to securely connect to your network before using RDP.
3. Implement Two-Factor Authentication (2FA)
Use tools like Duo Security to add an extra layer of authentication before allowing an RDP session to start.
4. Monitor and Limit RDP Access
- Restrict RDP access to specific IP addresses.
- Use intrusion detection tools to monitor login attempts.
- Regularly update your operating system to patch vulnerabilities.
Conclusion
While port 3389 is the standard for RDP, changing it can enhance security, prevent automated attacks, and comply with network policies. However, modifying the port is only one part of securing remote access—additional steps such as enabling NLA, using a VPN, and implementing 2FA should be considered.
By following best practices, you can safely use RDP with a customized port while minimizing security risks and ensuring a seamless remote access experience.
Remote Desktop Protocol (RDP) is a proprietary protocol developed by Microsoft to remotely connect to a Windows system using a graphical user interface. RDP is built into Windows by default. RDP listens on TCP port 3389 and udp port 3389. Previously, the RDP software was called Terminal Services client but now it’s called Remote Desktop Connection.
Windows comes with a remote desktop client that can be used to access the complete Windows Desktop environment remotely. It’s very useful for people who use multiple computers for work. One of our readers has asked about the RDP port and how to tweak it for security.
You can open the Remote Desktop Connection client by going to Run –> mstsc.
Simply put, the default port for using the Remote Desktop Protocol is 3389. This port should be open through Windows Firewall to make it RDP accessible within the local area network. If you want to make it accessible over the Internet (which is not safe), the RDP port should be forwarded through the main Internet router to work properly.
Let’s talk about how to open port 3389 in Windows Firewall and the router.
Table of Contents
Allow RDP port through Windows Firewall
- Go to Windows Settings (Windows key + i)
- Go to Update & Security –> Windows Security and click on Firewall & network protection from the right-hand listing. This will open a new window.
Windows Firewall and network protection - Click the link Allow an app through firewall
Allow an app through Firewall - Click on Change settings
Firewall change settings - Search for Remote Desktop from the list. It should be there by default. If it is not there, you should click on Allow another app button and navigate to the following:
C:\Windows\System32\mstsc.exe
Allow Remote Desktop through firewall private or public - If you want to allow Remote Desktop on the local network only, check the checkbox labeled Private. If you want it publicly available, you should check the Public checkbox too.
- Press OK for the changes to take effect.
Allow RDP port through Router (using NAT Translation)
If you want to use Windows Remote Desktop over the Internet, you will need to do two steps:
- Allow RDP port through public network from Windows Firewall (or any other firewall) as we did in the previous step.
- Allow RDP port through the router which is giving you internet access and then translate the incoming port 3389 to the computer of our choice.
Please note that if you are connected to the Internet using a public IP, you don’t need the second step but normally people are connected to the Internet using routers, both home, and corporates.
The configuration for opening a port is different for each router. Since I’m using Kerio Control for my office network, I will walk you through the steps using Kerio Control. The terminology should be similar for most routers so it’ll be easy for you to follow the same steps for your specific router.
- Open your router’s configuration page. Normally it should be the same as your default gateway. For me, it is http://192.168.1.1
- After logging in, go to Traffic Rules –> Add a new rule
Kerio create a new traffic rule - Name your rules and keep them generic. Keep the action to Allow and press the Next button.
- Keep the source to Any. That means users will be able to connect to this specific port from anywhere.
Kerio Control source rule - Add Firewall to the Destination. You can keep it unchanged if you want.
- Under Services, select Port and specify 3389.
Kerio Control add port - Under NAT Translation, enable destination NAT, specify the IP address of your computer and also specify the port translation to 3389.
Kerio Control enable destination NAT
Change the default port of RDP
If you are opening RDP over the Internet, keeping the RDP port to 3389 is a security threat. It is recommended that you change the default port from 3389 to something above 10000. I, normally, keep it between 30000 and 40000 which is relatively safe as the port scanners will start scanning from port 1.
If you want to change the RDP port, follow the steps below:
- Go to Run –> regedit to open the Registry Editor.
- Locate the following key:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\ - In the right-hand pane, double-click on PortNumber
- Change the value to Decimal and specify the port number between 1001 to 254535.
Steps to change default RDP port number
Check if port 3389 is open and listening
There are times when you successfully open the RDP port but you’re unable to connect to the computer remotely. In that case, make sure that you are able to access port 3389 (or any other port if you have changed it) remotely. Follow the steps below to check if port 3389 is open and listening.
- Open PowerShell by going to Run –> powershell
- Run the following command
tnc 192.168.1.2 -port 3389
Replace the IP address 192.168.1.2 with your computer’s IP. Replace it with your router’s public IP if you have allowed public access to your computer through the router. The value of TcpTestSucceeded should be True.
If you want to check the port using the command prompt, you can follow this guide.
I hope this guide is useful for you and now you can control your remote desktop the way you want. If you have any questions or if I have left any confusion in this article, let me know through the comments below. Your comments are highly appreciated!
Remote Desktop Protocol (RDP) allows users to connect to a Windows server remotely, making it an essential tool for system administrators and remote workers. However, since RDP uses the default port 3389, it is frequently targeted by hackers attempting brute-force attacks and unauthorized access. Change the default RDP port in Windows, which enhances security by reducing the risk of automated attacks and making your system less visible to cyber threats.
By modifying the RDP port, you add an extra layer of protection against malicious bots and attackers scanning for open ports. Change the default RDP port to make your system less vulnerable to brute-force attacks and unauthorized access. This simple yet effective security measure helps protect sensitive data and prevent unauthorized login attempts. In this guide, I will walk you through the step by step process of changing the RDP port in Windows, configuring firewall settings, and ensuring a secure remote connection.
Prerequisites
- Administrator access to the Windows server .
- Firewall access to allow the new RDP port.
- Backup of the Windows Registry before making changes.
1. Open the Windows Registry Editor
- Press Win + R on your keyboard to open the Run dialog box.
2. Type regedit and press Enter. This will launch the Registry Editor.
3. In the Registry Editor, navigate to :
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\TerminalServer\WinStations\RDP-Tcp
Look for the entry named PortNumber in the right-hand pane.
2. Modify the RDP Port
- Double-click on PortNumber to edit its value.
- In the Edit DWORD (32-bit) Value window, select Decimal under Base.
- To change the default RDP port, change the value from 3389 to a new port number of your choice (e.g., 4488 or any number between 1024 and 65535).
- Click OK to save the changes.
- Close the Registry Editor.
3. Configure Windows Firewall to Allow the New RDP Port
Since we changed the RDP port, we need to allow it through Windows Defender Firewall.
- Open Control Panel and go to Windows Defender Firewall.
- Click on Advanced settings on the left sidebar.
- In the Windows Defender Firewall with Advanced Security window, click Inbound Rules.
- Click on New Rule in the right-hand panel.
- Select Port and click Next.
- Choose TCP and enter your new RDP port (e.g., 448 in the Specific local ports field.
- Click Next, select Allow the connection, and click Next again.
- Ensure all profiles (Domain, Private, Public) are checked and click Next.
- Name the rule (e.g., “New RDP Port Rule”) and click Finish.
in the Specific local ports field.4. Restart the RDP Service
- For the changes to take effect, restart the Remote Desktop Service:
2. Open Command Prompt as Administrator (search cmd, right-click, and select Run as administrator).
3. Run the following command to stop and restart the RDP service.
net stop termservice && net start termservice
Alternatively, you can restart your computer for the changes to take effect.
5. Connect Using the New RDP Port
1. After changing the port, you must specify the new port when connecting via Remote Desktop:
2. Open Remote Desktop Connection .
3. In the Computer field, enter your server’s IP or hostname followed by a colon and the new port number.
IP:4488
4. Click Connect and enter your credentials to log in.
Conclusion
Change the default RDP port also enhances security by reducing exposure to brute-force attacks and unauthorized login attempts. By using a non-standard port above 1024 but below 65535, you make it more difficult for attackers to scan and exploit your remote desktop connection. However, simply changing the port is not enough. It’s crucial to update your Windows Firewall rules also.
At Veeble, we offer secure and high performance Windows RDP solutions designed for seamless remote access with enhanced security features. Whether you’re a business professional, developer, or trader, our Veeble Windows RDP services provide optimized performance, dedicated resources, and advanced security configurations to keep your connections safe.
By implementing these security measure, you can significantly improve the protection of your Windows server against cyber threats, ensuring reliable and secure remote access.
Windows Hosting with 24/7 Support
Round-the-clock expert support for all your Windows hosting needs, including Plesk and server assistance. We’re always here to help!
Start Hosting
,
This article contains step-by-step instructions on how to change the default Remote Desktop Port in Windows 10. In all Windows versions the default Remote Desktop Port (RDP) is 3389 (TCP/UDP). But, if you want to keep your computer away from Internet attacks, I recommend to change the default RDP Port number 3389 to another one.
In order to properly change the default listening port for Remote Desktop Connections, you have first to change the RDP port in Windows Registry, and then to add two (2) new rules in Windows Firewall for the incoming connections on the new RDP port.
How to Change RDP Default Port in Windows 10.
Step 1. Change Remote Desktop Port in Registry.
1. With the help of this List of TCP and UDP port numbers, find out an unused port.
2. Open Registry Editor. To do that:
1. Simultaneously press the Win + R keys to open the run command box.
2. Type regedit and press Enter to open Registry Editor.
3. Navigate to this key at left pane:
- HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
4. At the right pane double-click at PortNumber.
5. Select Decimal and type the new port number (e.g. ‘3489’ in this example) in the Value data box. When done, click OK.
6. Close the Registry Editor.
Step 2. Add NEW Remote Desktop Port ( RDP) in Windows Firewall.
After changing the Remote Desktop Port in Windows registry, you must allow the incoming traffic on the new RDP port in Windows Firewall, by following the instructions below:
1. Go To Control Panel > All Control Panel Items > Windows Firewall.
2. Click Advanced settings on the left.
3. Select Inbound Rules on the left and click New Rule.
4. Select Port at first screen and click Next.
5. At the next screen leave the TCP protocol selected, and at Specific local ports type the new port number for the RDP connections. (e.g. ‘3489’ in this example). When done, click Next.
6. At next screen leave the default setting (Allow the connection) and click Next.
6. Click Next to apply the new rule to all network profiles.
7. Finally type a recognizable name for the new RDP port and click Finish.
8. Now perform again the steps 3-7, but this time at step-4, create a new incoming rule for the UDP protocol.
9. After creating the two (2) incoming rules, restart your PC and you’ll be ready to connect to your PC through the remote desktop connection by using the new port number.*
Additional help: To remotely connect to your PC, through Remote Desktop Connection, type your computer’s IP Address and the new RDP port number at this format: *
-
Computer-IP-Adrress:RDP-Number
e.g. If your Computer’s IP address is ‘192.168.1.90’ and the new RDP port is ‘3489’, type «192.168.1.90:3489».
That’s it! Let me know if this guide has helped you by leaving your comment about your experience. Please like and share this guide to help others.
If this article was useful for you, please consider supporting us by making a donation. Even $1 can a make a huge difference for us in our effort to continue to help others while keeping this site free:
- Author
- Recent Posts
Konstantinos is the founder and administrator of Wintips.org. Since 1995 he works and provides IT support as a computer and network expert to individuals and large companies. He is specialized in solving problems related to Windows or other Microsoft products (Windows Server, Office, Microsoft 365, etc.).