How to Change the RDP Port on Windows

TLDR: Windows Remote Desktop listens on port 3389 by default, which draws constant automated login attempts. Moving it to a custom port cuts the noise. Here's how to change it safely — keep your current session open until the new port is confirmed.

Windows Remote Desktop listens on TCP port 3389 by default. Because that's well known, it attracts constant automated login attempts. Moving RDP to a different port reduces noise and casual scanning. Here's how to do it safely.

Before you start: pick a port between 1025 and 65535 that isn't already in use (this guide uses 3390 as an example). You'll need administrator access.

Step 1: Change the port in the registry

Open Registry Editor (press Win+R, type regedit) and navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Find the PortNumber value, double-click it, select Decimal, and enter your new port (e.g. 3390). Click OK.

Prefer PowerShell? Run this as Administrator:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 3390

Step 2: Allow the new port in Windows Firewall

Open PowerShell as Administrator and add an inbound rule so you can still connect:

New-NetFirewallRule -DisplayName "RDP-Custom-3390" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow

If your provider has an external firewall or security group, open the new port there too.

Step 3: Restart the service (or the server)

Restart-Service TermService -Force

If the service is in use, simply reboot the server. Do not disconnect your current session until you've confirmed the new port works.

Step 4: Connect on the new port

In the Remote Desktop client, enter the address followed by a colon and the port:

your-server-ip:3390

Optional: keep the old port open until confirmed

Leave port 3389 allowed in the firewall until you've verified a successful login on the new port, then remove it:

Remove-NetFirewallRule -DisplayName "RDP-Custom-3390"   # (example - remove the OLD rule, not this one)

That's it - RDP now runs on your chosen port. For more hardening, see our firewall guide. Need a Windows RDP server? See our plans.