RDP Port 3389: How to Check and Change the Remote Desktop Port

Remote Desktop listens on TCP port 3389 by default. How to check the port your Windows server uses, change it without locking yourself out and connect to the new port.

Remote Desktop listens on TCP port 3389 by default. [1] Windows can also use UDP 3389 for a faster transport when the network allows it. This guide shows how to check which port your server uses, how to change it without locking yourself out, and how to connect to the new port. The commands work on Windows Server 2019, 2022 and 2025 and need an Administrator PowerShell window.

Allow the new port in the firewall before you change the Remote Desktop port. If Remote Desktop restarts on a port the firewall blocks, you lose access to the server until the setting is reverted.

What port 3389 does

Port 3389 is where the Remote Desktop service waits for connections. Every client, from Remote Desktop Connection on Windows to Windows App on macOS and phones, connects to that port unless you give it another one.

Moving Remote Desktop to another port cuts down the automated login attempts that scan port 3389 across the internet. It is not protection on its own: anyone who scans all ports can still find it. Keep a strong password, Network Level Authentication and, where you can, a firewall rule that allows only your own addresses.

Check which port Remote Desktop uses

Read the port from the registry value Remote Desktop reads at startup: [1]

Current Remote Desktop port

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber'

The PortNumber line shows the port, for example PortNumber : 3389.

To confirm that the service listens on it:

Is something listening on the port?

Get-NetTCPConnection -State Listen -LocalPort 3389

From your own Windows computer, check that the port is reachable over the internet. Replace the address with your server's IP: [3]

Test the port from your computer

Test-NetConnection -ComputerName 203.0.113.10 -Port 3389

TcpTestSucceeded : True means the port is open from where you are.

Change the Remote Desktop port

1. Choose a free port

Pick a port between 1025 and 65535 that no other service uses, for example 3390 or a higher number. Check that it is free; this command prints nothing when nothing listens on the port:

PowerShell

Get-NetTCPConnection -State Listen -LocalPort 3390 -ErrorAction SilentlyContinue

2. Allow the new port in the Windows firewall

Create inbound rules for TCP and UDP on the new port: [1] [2]

Firewall rules for the new port

$port = 3390
New-NetFirewallRule -DisplayName "Remote Desktop (TCP $port)" -Direction Inbound -Protocol TCP -LocalPort $port -Action Allow
New-NetFirewallRule -DisplayName "Remote Desktop (UDP $port)" -Direction Inbound -Protocol UDP -LocalPort $port -Action Allow

If another firewall sits in front of the server, allow the port there too.

3. Change the port in the registry

Set the new port

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name 'PortNumber' -Value $port

4. Restart Remote Desktop

The new port takes effect when the Remote Desktop service restarts. Restarting it ends your current session, so save your work first:

Restart the Remote Desktop service

Restart-Service -Name TermService -Force

Restarting the whole server with Restart-Computer works as well.

5. Connect to the new port

Add the port to the server address with a colon, for example 203.0.113.10:3390: [1]

Remote Desktop Connection (Windows): type 203.0.113.10:3390 in the Computer field, or run mstsc /v:203.0.113.10:3390.
Windows App (macOS, iOS, iPadOS, Android): edit the saved PC and enter the address with the port.

6. Close port 3389

When the new port works, turn off the built-in rules that allow port 3389:

Disable the default Remote Desktop rules

Disable-NetFirewallRule -DisplayGroup 'Remote Desktop'

On a Windows installation in another language, the group carries the translated name; Get-NetFirewallRule -DisplayGroup *Remote* lists it.

If you cannot connect

The rule is missing or off: Get-NetFirewallRule -DisplayName 'Remote Desktop (TCP*' should list your rule with Enabled : True.
The service is not on the new port: Get-NetTCPConnection -State Listen -LocalPort 3390 should return a line.
Your own network blocks the port: office and public networks often allow only common ports outbound. Try from another connection.
You are locked out: contact support. As a last resort you can rebuild the server from the client area, which reinstalls the operating system and erases the data on it.

Keep Remote Desktop secure

Use a long, unique password for the Administrator account.
Keep Network Level Authentication on, as it is by default.
Allow the port only from your own IP addresses where you can: Set-NetFirewallRule -DisplayName "Remote Desktop (TCP 3390)" -RemoteAddress 198.51.100.7.
Install Windows updates regularly.

More steps are in 7 tips for securing your Remote Desktop connection.

Sources & references

Change Remote Desktop listening port on Windows and Windows Server — Microsoft Learn (accessed 2026-10-24)
New-NetFirewallRule — Microsoft Learn (accessed 2026-10-24)
Test-NetConnection — Microsoft Learn (accessed 2026-10-24)