Change the RDP Port on Windows Server: Registry, Firewall

You can change the RDP port on Windows Server in about five minutes: edit the PortNumber value in the registry, add a new firewall rule and restart the Remote Desktop service. Moving off the standard port 3389 sharply cuts the volume of automated password guessing by bots. Here are the exact steps and commands.

Why change the RDP port

Port 3389 is known to everyone, and automated scanners hammer it constantly looking for weak passwords. Moving RDP to another port is not full protection — it is a way to drop your server out of mass scans. Always combine it with strong passwords, IP restrictions and NLA.

Pick a port from the 49152–65535 range (dynamic ports), for example 52389, so it does not clash with other services.

Step 1. Change the port in the registry

Run PowerShell as Administrator. Set the new port (52389 in this example):

$port = 52389
Set-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value $port

Confirm the value was written:

Get-ItemProperty -Path 'HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber'

Step 2. Open the new port in the firewall

Create inbound rules for TCP and UDP on the new port:

New-NetFirewallRule -DisplayName "RDP Custom Port TCP" -Direction Inbound -Protocol TCP -LocalPort 52389 -Action Allow
New-NetFirewallRule -DisplayName "RDP Custom Port UDP" -Direction Inbound -Protocol UDP -LocalPort 52389 -Action Allow

Step 3. Restart the RDP service

For the new port to take effect, restart the Remote Desktop service:

Restart-Service -Name TermService -Force

If the service refuses to restart because of an active session, reboot the whole server:

Restart-Computer -Force

Step 4. Verify and connect

Make sure the server is listening on the new port:

Get-NetTCPConnection -LocalPort 52389 -State Listen

Now connect with the port after a colon. On Windows:

mstsc /v:203.0.113.10:52389

On Linux through xfreerdp:

xfreerdp /v:203.0.113.10 /port:52389 /u:Administrator /cert:ignore

Do not forget the old port

Once you have confirmed the new port works, disable or delete the rule for 3389 to close it:

Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

Frequently asked questions

Which port should I use instead of 3389?

Any free port in the 49152–65535 range that no other service occupies. Check with Get-NetTCPConnection -LocalPort <number> before assigning it.

I changed the port and now I cannot connect — what now?

Check three things: the PortNumber value in the registry, the firewall rule, and that your client actually specifies the port (IP:port). Also confirm the port is open on the provider or network side.

Does changing the port protect against hacking?

It only reduces the volume of automated scanning. Real protection comes from strong passwords, IP-based access limits, NLA and, where needed, a VPN in front of RDP.

Do I need to change the port in both the registry and the firewall?

Yes, both are required. The registry tells the service which port to listen on, and the firewall has to let that port through — without the second step the connection never arrives.

Setting up a server from scratch and want secure access from day one? Take a Windows VPS with full system access, or review the VPS hosting plans.