How to Change the Default RDP Port (3389) on Windows Server

Short version: RDP listens on port 3389 by default, and every attacker on the internet knows it. To change it, edit the PortNumber value under HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp in the Registry Editor, pick a port between 20000 and 60000, open that port in the firewall, restart the RDP service, and reconnect using IP:port. The change takes about five minutes and cuts automated brute-force noise dramatically.

Default port 3389 draws constant automated attacks; a custom port behind the firewall removes you from the mass-scan lists.

Why attackers target port 3389

Port 3389 is the default port for Remote Desktop Protocol (RDP) on every Windows server. Because the port is fixed and public knowledge, it is one of the most scanned ports on the internet: automated bots sweep the entire IPv4 address space around the clock, looking for servers that answer on 3389. Honeypot studies routinely show the first login attempts arriving within minutes of a new server going online.

Once a bot finds an open 3389, two things follow. Brute-force tools start hammering the login screen with millions of username and password combinations. And because the port is known, it is also an easy aim point for denial-of-service (DDoS) traffic that can slow the server down or knock it offline.

Does changing the RDP port actually help?

Honest answer: changing the RDP port removes you from the automated mass-scan lists that target 3389, which typically eliminates the vast majority of brute-force attempts and the log spam that comes with them. It does not make the server invisible: a determined attacker running a full port scan against your specific IP can still find the new port. Treat the port change as noise reduction and one layer of defense, and combine it with a strong password, Network Level Authentication and firewall rules. We cover those at the end of this guide.

Before you start: a 2-minute checklist

• You need administrator access to the server via Remote Desktop.
• Pick a new port between 20000 and 60000 that is easy for you to record, for example 45223. Avoid obvious choices like 3390 or 33890, which scanners also check.
• Make sure nothing else uses the port: run netstat -ano | findstr :45223 in CMD. No output means the port is free.
• Write the new port down before you change anything. You will need it for every future connection.
• On OMC Cloud you have a safety net: the console at console.omc.cloud gives you screen access to the server even if RDP is unreachable, so a mistake never locks you out permanently.

How to change the RDP port, step by step

Step 1 — Connect to the server and open the Registry Editor.
Connect via Remote Desktop, click Start, type regedit and press Enter.

Step 2 — Navigate to the RDP port setting.
In the Registry Editor, go to: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Step 3 — Change the PortNumber value.
Double-click PortNumber, select Decimal, replace 3389 with your new port (for example 45223) and click OK.

Step 4 — Allow the new port in Windows Firewall.
Before restarting anything, open CMD as Administrator and run: netsh advfirewall firewall add rule name="RDP Custom Port" dir=in action=allow protocol=TCP localport=45223

Step 5 — Restart the RDP service.
Either restart the server (Start, then Restart), or restart only the Remote Desktop service from an Administrator CMD: net stop termservice && net start termservice. Your current RDP session will disconnect; that is expected.

Step 6 — Open the port in the OMC Cloud firewall.
The server firewall is only half the path; the new port must also be open in the external firewall. Log in to the OMC Cloud console, select your server, open the Firewall tab and add a rule: Direction IN, Interface ANY, Protocol TCP, Port your new port, Policy ACCEPT. While you are there, delete or disable the old rule for 3389 so the default port is fully closed.

The whole change in six steps, then connect with IP:port.

The fast way: three PowerShell commands

Prefer to skip the GUI? Run these in an elevated PowerShell, in this order, replacing 45223 with your port:

• Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 45223
• New-NetFirewallRule -DisplayName "RDP Custom Port" -Direction Inbound -Protocol TCP -LocalPort 45223 -Action Allow
• Restart-Service TermService -Force

Then open the same port in the OMC Cloud firewall as described in Step 6 above.

Connecting with the new port

From now on, add the port to the address in the Remote Desktop client. In the Computer field type the server IP, a colon, and the port, for example: 203.0.113.5:45223. Saved .rdp files and connection managers need the same update. Everything else about the connection stays exactly the same.

Troubleshooting: locked out or cannot connect?

• Connection times out. In almost every case one of the two firewalls is missing the new rule. Verify the Windows Firewall rule and the OMC Cloud firewall rule both list your exact port and TCP.
• You forgot the new port. Open the server through the OMC console (no RDP needed), launch PowerShell and run: (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber
• You need to roll back. From the console, set PortNumber back to 3389 with the same command from the PowerShell section, restart TermService, and re-enable the 3389 firewall rules.
• Still stuck? OMC support is available 24/7 by phone, email or a ticket in the console, and can help you regain access.

Beyond the port change: harden RDP properly

A custom port cuts the noise; these measures stop the attacks that remain:

• Restrict by source IP. The strongest single move: in the OMC Cloud firewall, allow the RDP port only from your office or home IP addresses. Bots cannot brute-force a port they cannot reach.
• Keep Network Level Authentication (NLA) on. NLA requires credentials before a session is even created, which blocks many automated attacks and known RDP exploits.
• Use a long, unique password for every account with RDP rights, and rename or disable the default Administrator account where practical.
• Set an account lockout policy (for example, 10 failed attempts locks the account for 15 minutes) so brute-force attempts hit a wall.
• Consider a VPN. Placing RDP behind a VPN or private network removes it from the public internet entirely; combine this with the OMC private LAN between your servers.
• Watch the logs. Windows Event Viewer, Security log, event ID 4625 shows failed logins. After moving off 3389, the difference is usually dramatic.

Frequently asked questions

Does changing the RDP port stop brute-force attacks?
It stops the automated mass scans that target port 3389, which are the overwhelming majority of attempts. A targeted attacker can still find the new port with a full port scan, so pair the change with a strong password, NLA and firewall rules.

Which port should I use for RDP?
Any free port between 20000 and 60000 works well. Avoid predictable variations such as 3390, 33890 or 13389, because scanners try those too.

How do I check which port RDP is currently using?
Run (Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp').PortNumber in PowerShell. The value returned is the active RDP port.

Do I need to restart the server after changing the RDP port?
A full restart is not required. Restarting the Remote Desktop service with net stop termservice && net start termservice applies the change immediately.

I changed the RDP port and now I cannot connect. What do I do?
Check that the new port is allowed in both Windows Firewall and the OMC Cloud firewall, and that you typed IP:port in the RDP client. If you are still locked out, open the server via the OMC console, which works without RDP, and fix or revert the setting.

Is changing the RDP port enough to secure a server?
No. It is an effective noise-reduction layer, not full protection. Combine it with source-IP firewall rules, NLA, strong passwords and an account lockout policy for real security.

Does changing the port protect against DDoS?
It helps against opportunistic floods aimed at well-known ports, but a targeted DDoS at your IP address is unaffected. DDoS resilience comes from the network layer, which OMC data centers handle upstream.

How do I connect to RDP on a custom port?
In the Remote Desktop client, type the address as IP:port, for example 203.0.113.5:45223, and connect as usual.

Run Windows on a cloud that has your back

Every OMC Cloud Windows server comes with a per-server external firewall, console screen access that works even when RDP does not, daily backup options and a 24/7 human support team. Spin up a Windows VPS in seconds and apply this guide from minute one.