{"id":15367,"date":"2026-04-06T13:35:51","date_gmt":"2026-04-06T13:35:51","guid":{"rendered":"https:\/\/hostnoc-revamp.branex.org\/blog\/?p=15367"},"modified":"2026-04-07T07:52:57","modified_gmt":"2026-04-07T07:52:57","slug":"check-and-change-rdp-port","status":"publish","type":"post","link":"https:\/\/hostnoc-revamp.branex.org\/blog\/check-and-change-rdp-port\/","title":{"rendered":"How to Check and Change RDP Port Step-by-Step? 2026 Guide"},"content":{"rendered":"<p><b>The default RDP port is TCP 3389.<\/b><span style=\"font-weight: 400;\"> To check it, run <\/span><strong><em>Get-ItemProperty -Path &#8216;HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp&#8217; -name &#8216;PortNumber&#8217;<\/em><\/strong><span style=\"font-weight: 400;\"> in PowerShell. To change it, run <\/span><span style=\"font-weight: 400;\">Set-ItemProperty<\/span><span style=\"font-weight: 400;\"> with a new value between 1024 and 65535, open the new port in Windows Firewall, then restart the Remote Desktop service.<\/span><\/p>\n<h2>Key Takeaways:<\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>RDP uses 2 ports by default:<\/b><span style=\"font-weight: 400;\"> TCP 3389 carries the primary session, and UDP 3389 accelerates graphics and input transport. Both ports change when the listening port is reconfigured.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Port 3389 is the most scanned RDP port on the internet.<\/b><span style=\"font-weight: 400;\"> Automated bots probe exposed instances within minutes of them becoming reachable. Changing to a port in the 49152\u201365535 range removes the system from the majority of these scans.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>3 steps are mandatory after every port change:<\/b><span style=\"font-weight: 400;\"> update the registry value, create new inbound firewall rules for both TCP and UDP, and restart the TermService. Skipping any one of these 3 steps breaks remote access.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>PowerShell completes the full port change in 5 commands: <\/b><em><b>reg export<\/b><b> (backup), <\/b><b>Set-ItemProperty<\/b><b> (set port), 2\u00d7 <\/b><b>New-NetFirewallRule<\/b><b> (TCP + UDP firewall rules), <\/b><b>and Restart-Service<\/b><\/em><b><em> (apply changes)<\/em>,<\/b><span style=\"font-weight: 400;\"> with no reboot required.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Changing the port is 1 layer of defense, not a complete solution.<\/b><span style=\"font-weight: 400;\"> Network-level authentication, IP allowlisting at the perimeter firewall, and MFA provide the actual security guarantees.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>After changing the port, connect using the format <\/b><b><em>IP:Port<\/em>,<\/b><span style=\"font-weight: 400;\"> for example, <\/span><em><strong>192.168.1.100:49200<\/strong><\/em><span style=\"font-weight: 400;\">. Remote Desktop Connection does not detect the new port automatically.<\/span><\/li>\n<\/ul>\n<h2>What port does RDP use?<\/h2>\n<p><span style=\"font-weight: 400;\">Remote Desktop Protocol (RDP), developed by Microsoft, listens on <\/span><b>TCP port 3389<\/b><span style=\"font-weight: 400;\"> by default on all versions of Windows, including Windows 10, Windows 11, and Windows Server 2022. RDP also uses <\/span><b>UDP port 3389<\/b><span style=\"font-weight: 400;\"> for transport acceleration when available. Port 3389 is the IANA-assigned standard for RDP and has been the default since Windows XP.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Because port 3389 is universally known, automated scanners probe it millions of times per day. <a href=\"https:\/\/www.microsoft.com\/\" target=\"_blank\" rel=\"noopener nofollow\">Microsoft&#8217;s<\/a> own telemetry shows that exposed RDP instances receive brute-force login attempts within minutes of being reachable on the public internet.<\/span><\/p>\n<h2>Why change the RDP port?<\/h2>\n<p><span style=\"font-weight: 400;\">Changing the listening port from 3389 to a non-standard value reduces automated attack exposure by removing the system from the vast majority of port-3389-targeted scans. It does not replace authentication controls; it reduces noise so that other defenses (Network Level Authentication, MFA, VPN) operate against fewer live threats.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">3 concrete benefits of changing the default port:<\/span><\/p>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Lower brute-force volume<\/b><span style=\"font-weight: 400;\"> bots scanning specifically for port 3389 no longer hit the service.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Cleaner log<\/b><span style=\"font-weight: 400;\"> authentication logs contain fewer failed attempts, making genuine intrusion attempts easier to spot.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Better multi-server management,<\/b><span style=\"font-weight: 400;\"> assigning distinct ports across a server fleet, separates RDP traffic at the firewall level without additional tooling.<\/span><\/li>\n<\/ol>\n<p><b>Security note:<\/b><span style=\"font-weight: 400;\"> Port obfuscation is a single layer. Always combine it with NLA, strong passwords, IP allowlisting, and ideally an RD Gateway or <a href=\"https:\/\/hostnoc-revamp.branex.org\/blog\/business-vpn\/\" target=\"_blank\" rel=\"noopener\">VPN<\/a>.<\/span><\/p>\n<p><a href=\"https:\/\/hostnoc-revamp.branex.org\/blog\/rdp-server\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-15368\" src=\"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/RDP-Server-Need-Reliable-Remote-Desktop-Power-Launch-Your-RDP-Server-Today-with-24-7-Expert-Support.webp\" alt=\"RDP Server\" width=\"1920\" height=\"500\" title=\"\" srcset=\"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/RDP-Server-Need-Reliable-Remote-Desktop-Power-Launch-Your-RDP-Server-Today-with-24-7-Expert-Support.webp 1920w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/RDP-Server-Need-Reliable-Remote-Desktop-Power-Launch-Your-RDP-Server-Today-with-24-7-Expert-Support-768x200.webp 768w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/RDP-Server-Need-Reliable-Remote-Desktop-Power-Launch-Your-RDP-Server-Today-with-24-7-Expert-Support-1536x400.webp 1536w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/RDP-Server-Need-Reliable-Remote-Desktop-Power-Launch-Your-RDP-Server-Today-with-24-7-Expert-Support-260x68.webp 260w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/RDP-Server-Need-Reliable-Remote-Desktop-Power-Launch-Your-RDP-Server-Today-with-24-7-Expert-Support-50x13.webp 50w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/RDP-Server-Need-Reliable-Remote-Desktop-Power-Launch-Your-RDP-Server-Today-with-24-7-Expert-Support-150x39.webp 150w\" sizes=\"auto, (max-width: 1920px) 100vw, 1920px\" \/><\/a><\/p>\n<h2>How to check the RDP port in Windows Server 2022 (PowerShell)<\/h2>\n<p><span style=\"font-weight: 400;\">Run the following command in an elevated PowerShell session. The result appears instantly, no reboot required.<\/span><\/p>\n<table style=\"height: 108px;\" width=\"905\">\n<tbody>\n<tr>\n<td>powershell<\/p>\n<p><em><strong>Get-ItemProperty -Path &#8216;HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp&#8217; -name &#8216;PortNumber&#8217;<\/strong><\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">The output displays the active port number. A value of <\/span><em><strong>3389<\/strong><\/em><span style=\"font-weight: 400;\"> confirms the default is still in use.<\/span><\/p>\n<h2>How to change the RDP port using PowerShell (Windows 10, 11 &amp; Server 2022)<\/h2>\n<p><span style=\"font-weight: 400;\">The PowerShell method applies identically to Windows 10, Windows 11, Windows Server 2019, and Windows Server 2022. Complete all 5 steps in sequence, skipping the firewall step, locks you out of the system.<\/span><\/p>\n<h3>Step 1 \u2014 Back up the registry branch<\/h3>\n<table>\n<tbody>\n<tr>\n<td>PowerShell<span style=\"font-weight: 400;\">reg export <\/span><em><strong>&#8220;HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp&#8221; &#8220;$env:USERPROFILE\\Desktop\\RDP-Tcp-backup.reg&#8221;<\/strong><\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<h3>Step 2 \u2014 Set the new port number<\/h3>\n<p><span style=\"font-weight: 400;\">Replace <\/span><em><strong>&lt;NewPort&gt;<\/strong><\/em><span style=\"font-weight: 400;\"> with a value between 1024 and 65535 that no other service on the machine uses. Values in the 49152\u201365535 range (IANA dynamic\/private range) carry the lowest collision risk.<\/span><\/p>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">powershell<\/span><\/p>\n<p><em><strong>$portValue = <\/strong><\/em>&lt;NewPort&gt;<\/p>\n<p><em><strong>Set-ItemProperty <\/strong><\/em>-Path<em><strong> &#8216;HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp&#8217; <\/strong><\/em>-name<em><strong> &#8216;PortNumber&#8217; <\/strong><\/em>-Value<em><strong> $portValue<\/strong><\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>&nbsp;<\/p>\n<h3>Step 3 \u2014 Allow the new port through Windows Firewall<\/h3>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">powershell<\/span><\/p>\n<p><em><strong>New-NetFirewallRule <\/strong><\/em>-DisplayName <em><strong>&#8220;RDP-Custom-TCP-In&#8221; <\/strong><\/em>-Profile Any -Direction Inbound -Action Allow -Protocol TCP -LocalPort<em><strong> $portValue<\/strong><\/em><\/p>\n<p><em><strong>New-NetFirewallRule <\/strong><\/em>-DisplayName<em><strong> &#8220;RDP-Custom-UDP-In&#8221; <\/strong><\/em>-Profile Any -Direction Inbound -Action Allow -Protocol UDP -LocalPort<em><strong> $portValue<\/strong><\/em><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><span style=\"font-weight: 400;\">Both TCP and UDP rules are required. RDP falls back to TCP-only if the UDP rule is absent, but creating both rules preserves full performance.<\/span><\/p>\n<h3>Step 4 \u2014 Block the old port (optional but recommended)<\/h3>\n<table>\n<tbody>\n<tr>\n<td><span style=\"font-weight: 400;\">powershell<\/span><\/p>\n<p><em><strong>New-NetFirewallRule<\/strong><\/em><span style=\"font-weight: 400;\"> -DisplayName <\/span><em><strong>&#8220;RDP-Block-3389-TCP&#8221;<\/strong><\/em><span style=\"font-weight: 400;\"> -Profile Any -Direction Inbound -Action Block -Protocol TCP -LocalPort 3389<\/span><\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>Step 5 \u2014 Restart the Remote Desktop service<\/h3>\n<p><span style=\"font-weight: 400;\">powershell<\/span><\/p>\n<p><em><strong>Restart-Service<\/strong><\/em><span style=\"font-weight: 400;\"> -Name TermService -Force<\/span><\/p>\n<p><span style=\"font-weight: 400;\">## How to change the RDP port using Registry Editor<\/span><\/p>\n<p><span style=\"font-weight: 400;\">The registry method produces the same result as PowerShell<\/span><span style=\"font-weight: 400;\">.<\/span><span style=\"font-weight: 400;\"> Use it when PowerShell is unavailable or when working on a single machine interactively<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><b>Step 1<\/b><span style=\"font-weight: 400;\"> \u2014 Press `Win + R`<\/span><span style=\"font-weight: 400;\">,<\/span> <em><strong>type<\/strong><\/em><span style=\"font-weight: 400;\"> `regedit`<\/span><span style=\"font-weight: 400;\">,<\/span><span style=\"font-weight: 400;\"> and press Enter<\/span><span style=\"font-weight: 400;\">.<\/span><span style=\"font-weight: 400;\"> Accept the UAC prompt<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><b>Step 2<\/b><span style=\"font-weight: 400;\"> \u2014 Navigate to:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8220;`<\/span><\/p>\n<p><span style=\"font-weight: 400;\">HKEY_LOCAL_MACHINE\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><b>Step 3<\/b><span style=\"font-weight: 400;\"> \u2014 Double-click the `PortNumber` value<\/span><span style=\"font-weight: 400;\">.<\/span> <em><strong>Select<\/strong><\/em><span style=\"font-weight: 400;\"> **Decimal**<\/span><span style=\"font-weight: 400;\">,<\/span><span style=\"font-weight: 400;\"> enter the new port number<\/span><span style=\"font-weight: 400;\">,<\/span><span style=\"font-weight: 400;\"> and click OK<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><b>Step 4<\/b><span style=\"font-weight: 400;\"> \u2014 Close Registry Editor<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><b>Step 5<\/b><span style=\"font-weight: 400;\"> \u2014 Add a firewall inbound rule <\/span><span style=\"font-weight: 400;\">for<\/span><span style=\"font-weight: 400;\"> the new port <\/span><span style=\"font-weight: 400;\">(<\/span><span style=\"font-weight: 400;\">TCP and UDP<\/span><span style=\"font-weight: 400;\">)<\/span> <span style=\"font-weight: 400;\">using<\/span><span style=\"font-weight: 400;\"> the PowerShell commands in Step 3 above<\/span><span style=\"font-weight: 400;\">,<\/span><span style=\"font-weight: 400;\"> or manually through Windows Defender Firewall \u2192 Advanced Settings \u2192 Inbound Rules \u2192 New Rule<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><b>Step 6<\/b><span style=\"font-weight: 400;\"> \u2014 Restart the system or run <em><strong>`<\/strong><\/em><\/span><em><strong>Restart-Service<\/strong><\/em><span style=\"font-weight: 400;\"> -Name TermService -Force` in PowerShell<\/span><span style=\"font-weight: 400;\">.<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8212;<\/span><\/p>\n<p><span style=\"font-weight: 400;\">## How to connect after changing the RDP port<\/span><\/p>\n<p>&nbsp;<\/p>\n<p><span style=\"font-weight: 400;\">Open Remote Desktop Connection and enter the target address in the format `IP:Port` or `hostname:Port`<\/span><span style=\"font-weight: 400;\">.<\/span> <span style=\"font-weight: 400;\">For<\/span><span style=\"font-weight: 400;\"> example:<\/span><\/p>\n<p><span style=\"font-weight: 400;\">&#8220;`<\/span><\/p>\n<p><span style=\"font-weight: 400;\">192<\/span><span style=\"font-weight: 400;\">.<\/span><span style=\"font-weight: 400;\">168<\/span><span style=\"font-weight: 400;\">.<\/span><span style=\"font-weight: 400;\">1<\/span><span style=\"font-weight: 400;\">.<\/span><span style=\"font-weight: 400;\">100:49200<\/span><\/p>\n<p><span style=\"font-weight: 400;\">Windows Remote Desktop Connection accepts the colon notation directly. No additional configuration is required on the client side.<\/span><\/p>\n<h2>4 common mistakes when changing the RDP port<\/h2>\n<ol>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Skipping the firewall rule,<\/b><span style=\"font-weight: 400;\"> the new port is blocked by Windows Firewall by default. The service changes ports, but the connection fails at the firewall level. Always create the inbound rule before closing the current session.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Not restarting the service,<\/b><span style=\"font-weight: 400;\"> the registry change does not take effect until the <\/span><em><strong>TermService<\/strong><\/em><span style=\"font-weight: 400;\"> restarts. Run <\/span><em><strong>Restart-Service -Name TermService -Force<\/strong><\/em><span style=\"font-weight: 400;\"> or reboot.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Forgetting to document the new port, store<\/b><span style=\"font-weight: 400;\"> the port number in a password manager, runbook, or server inventory. Losing track of a non-standard port means reconfiguring the server from console access.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><b>Not having a fallback access method<\/b><span style=\"font-weight: 400;\"> on a cloud VM or co-located server, confirm that console access (Azure Serial Console, AWS EC2 Connect, IPKVM) is available before making changes. An incorrect firewall rule with no fallback requires a support ticket to resolve.<\/span><\/li>\n<\/ol>\n<p><a href=\"https:\/\/hostnoc-revamp.branex.org\/blog\/windows-vps-hosting\" target=\"_blank\" rel=\"noopener\"><img loading=\"lazy\" decoding=\"async\" class=\"alignnone size-full wp-image-15370\" src=\"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/Windows-VPS-Run-Windows-Applications-Seamlessly.webp\" alt=\"Windows VPS\" width=\"1920\" height=\"500\" title=\"\" srcset=\"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/Windows-VPS-Run-Windows-Applications-Seamlessly.webp 1920w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/Windows-VPS-Run-Windows-Applications-Seamlessly-768x200.webp 768w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/Windows-VPS-Run-Windows-Applications-Seamlessly-1536x400.webp 1536w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/Windows-VPS-Run-Windows-Applications-Seamlessly-260x68.webp 260w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/Windows-VPS-Run-Windows-Applications-Seamlessly-50x13.webp 50w, https:\/\/hostnoc-revamp.branex.org\/blog\/wp-content\/uploads\/2026\/04\/Windows-VPS-Run-Windows-Applications-Seamlessly-150x39.webp 150w\" sizes=\"auto, (max-width: 1920px) 100vw, 1920px\" \/><\/a><\/p>\n<h2>RDP port change: Best practices for 2026<\/h2>\n<ul>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Choose a port in the <\/span><b>49152\u201365535<\/b><span style=\"font-weight: 400;\"> range to avoid conflicts with registered services.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Enable <\/span><b>Network Level Authentication (NLA)<\/b><span style=\"font-weight: 400;\">, which forces credential verification before a full RDP session is established, blocking unauthenticated session initiation even if the port is discovered.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Restrict the new port at the <\/span><b>perimeter firewall<\/b><span style=\"font-weight: 400;\"> to trusted IP ranges only. Port obscurity combined with IP allowlisting reduces the attack surface to near zero for automated threats.<\/span><\/li>\n<li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Use an <\/span><b>RD Gateway<\/b><span style=\"font-weight: 400;\"> to tunnel RDP over HTTPS (port 443) in enterprise environments. This eliminates the need to expose any RDP port directly to the internet.<\/span><\/li>\n<li aria-level=\"1\"><b>Audit port usage quarterly<\/b><span style=\"font-weight: 400;\"> run <\/span><em><strong>netstat -ano | findstr :&lt;NewPort&gt;<\/strong><\/em><span style=\"font-weight: 400;\"> to confirm the port remains active and uncontested.<\/span><\/li>\n<\/ul>\n<h3 style=\"text-align: center;\">Frequently Asked Questions About Check &amp; Change RDP Port<\/h3>\n<p style=\"text-align: center;\">    <div class=\"mfn-acc faq-accordion parent\">\n        <div class=\"mfn-acc faq-accordion\">\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            What port does RDP use by default?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">RDP uses TCP port 3389 and UDP port 3389 by default on all Windows versions.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            Does changing the RDP port protect the server?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">Changing the port reduces automated scan exposure but does not replace authentication controls. NLA, MFA, and IP allowlisting provide the actual security guarantees.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            How to change the RDP port without a restart?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">Run <\/span><em><strong>Restart-Service -Name TermService -Force<\/strong><\/em><span style=\"font-weight: 400\"> in PowerShell. This restarts only the Remote Desktop service without rebooting the OS, so other running services and sessions remain unaffected.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            What is the safest port to use for RDP?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">Ports in the IANA dynamic range (49152\u201365535) carry the lowest risk of conflicting with registered services. Avoid ports below 1024 (reserved) and well-known ports such as 80, 443, 8080, and 3306.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            How to add a firewall rule for the new RDP port?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">Run <\/span><em><strong>New-NetFirewallRule -DisplayName &#8220;RDP-Custom-TCP-In&#8221; -Profile Any -Direction Inbound -Action Allow -Protocol TCP -LocalPort &lt;Port&gt;<\/strong><\/em><span style=\"font-weight: 400\"> in an elevated PowerShell session. Repeat the command with <\/span><em><strong>-Protocol UDP<\/strong><\/em><span style=\"font-weight: 400\"> for the UDP rule.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            Does RDP use TCP or UDP?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">RDP uses both. TCP port 3389 carries the primary session. UDP port 3389 accelerates transport for graphics and input when the network supports it. Both ports change when the listening port is reconfigured.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            How to change the RDP port on Windows 10?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">The process is identical to Windows Server 2022. Use the PowerShell <\/span><em><strong>Set-ItemProperty<\/strong><\/em><span style=\"font-weight: 400\"> command in Step 2 above, then add the firewall rule and restart the <\/span><em><strong>TermService<\/strong><\/em><span style=\"font-weight: 400\">.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            How to verify the RDP port change worked?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">Run <\/span><em><strong>Get-ItemProperty -Path<\/strong><\/em><\/p>\n<p><em><strong> &#8216;HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal <\/strong><\/em><\/p>\n<p><em><strong>Server\\WinStations\\RDP-Tcp&#8217; -name &#8216;PortNumber&#8217;<\/strong><\/em><span style=\"font-weight: 400\"> in PowerShell. The output reflects the active port immediately after the service restart.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                            <div class=\"mfn-acc-item\">\n                    <div class=\"mfn-acc-header\">\n                        <img decoding=\"async\" class=\"faq-icon\" src=\"https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/close.png\" alt=\"icon\" title=\"\">\n                        <h5 class=\"mfn-acc-title\">\n                            Is port 3389 safe to leave open?                        <\/h5>\n                    <\/div>\n                    <div class=\"mfn-acc-content\">\n                        <p><p><span style=\"font-weight: 400\">No. Leaving port 3389 open to the internet exposes your system to brute-force attacks. Always restrict access using firewall rules, VPN, or an RD Gateway.<\/span><\/p>\n<\/p>\n                    <\/div>\n                <\/div>\n                    <\/div>\n    <\/div>\n    <script>\n        document.addEventListener('DOMContentLoaded', function() {\n            const faqHeaders = document.querySelectorAll('.mfn-acc-header');\n            faqHeaders.forEach(header => {\n                header.addEventListener('click', function() {\n                    const content = this.nextElementSibling;\n                    const icon = this.querySelector('.faq-icon');\n                    \n                    if (content.style.display === 'block') {\n                        content.style.display = 'none';\n                        icon.src = 'https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/question-empty.png';\n                    } else {\n                        content.style.display = 'block';\n                        icon.src = 'https:\/\/www.hostnoc.com\/wp-content\/uploads\/2024\/12\/question-fill.png';\n                    }\n                });\n            });\n        });\n    <\/script>\n    <style>\n        .faq-accordion .mfn-acc-item {\n            margin-bottom: 15px;\n        }\n        .mfn-acc-header {\n            cursor: pointer;\n            padding: 15px;\n            display: flex;\n            align-items: center;\n        }\n        .faq-icon {\n            margin-right: 10px;\n            width: 20px;\n            height: 20px;\n            transition: transform 0.3s;\n        }\n        .mfn-acc-title {\n            margin: 0;\n            color: #000000;\n            font-size: 17px;\n            line-height: 20px;\n        }\n        .mfn-acc-content {\n            display: none;\n            padding: 15px;\n            padding-top: 0;\n            padding-left: 7%;\n        }\n        .mfn-acc.faq-accordion{\n            box-shadow: 1px 1px 50px rgb(0 0 0 \/ 10%);\n            background: #fff;\n            width: 100%;\n            padding: 30px 20px 10px;\n            border-radius: 10px;\n        }\n        .mfn-acc-item:not(:last-child) {\n            border-bottom: 1px solid #e6e9ee;\n        }\n        .mfn-acc.faq-accordion.parent{\n            border-radius: 70px;\n            padding: 0 0 10px;\n            background: #971A1D;\n        }\n    <\/style>\n    <\/p>\n","protected":false},"excerpt":{"rendered":"<p>The default RDP port is TCP 3389. To check it, run Get-ItemProperty -Path &#8216;HKLM:\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\\WinStations\\RDP-Tcp&#8217; -name &#8216;PortNumber&#8217; in PowerShell. To change it, run Set-ItemProperty with a<span class=\"excerpt-hellip\"> [\u2026]<\/span><\/p>\n","protected":false},"author":15,"featured_media":15371,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"content-type":"","footnotes":""},"categories":[29,203],"tags":[],"class_list":["post-15367","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-featured-post","category-guide"],"acf":[],"_links":{"self":[{"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/posts\/15367","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/users\/15"}],"replies":[{"embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/comments?post=15367"}],"version-history":[{"count":2,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/posts\/15367\/revisions"}],"predecessor-version":[{"id":15388,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/posts\/15367\/revisions\/15388"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/media\/15371"}],"wp:attachment":[{"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/media?parent=15367"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/categories?post=15367"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostnoc-revamp.branex.org\/blog\/wp-json\/wp\/v2\/tags?post=15367"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}