Remote Desktop listens on TCP port 3389, and every internet scanner knows it. A Windows VPS on the default port receives thousands of password guesses per day. Moving RDP to another port won’t stop a determined attacker, but it removes most automated noise and the account lockouts it causes. Here’s how to do it safely.

Before you start

  • Pick a port between 1025 and 65535 that nothing else uses — for example 53389 or 49833. Avoid well-known ports of other services.
  • Keep your current RDP session open until you’ve tested the new port.
  • Know how to reach the server’s VNC console in your VPS control panel — your way back in if something goes wrong.

Step 1: allow the new port in Windows Firewall

Open PowerShell as Administrator:

$port = 53389
New-NetFirewallRule -DisplayName "RDP TCP $port" -Direction Inbound -Protocol TCP -LocalPort $port -Action Allow
New-NetFirewallRule -DisplayName "RDP UDP $port" -Direction Inbound -Protocol UDP -LocalPort $port -Action Allow

RDP uses UDP as well as TCP for better performance on modern clients; TCP alone works if you skip the UDP rule.

Step 2: change the listening port

The port lives in the registry. With PowerShell:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value $port
Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber

Or with Registry Editor (regedit): navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, double-click PortNumber, choose Decimal, and enter the new port.

Step 3: restart the Remote Desktop service

Restart-Service -Name TermService -Force

Your current session will disconnect. That’s expected — reconnect on the new port (step 4). If you prefer, reboot the server instead (Restart-Computer).

Step 4: connect on the new port

In the Remote Desktop client (mstsc), add the port after a colon:

203.0.113.10:53389

On macOS with Windows App (formerly Microsoft Remote Desktop), enter the same host:port as the PC name. Save it in the connection profile so you don’t have to remember it.

Step 5: close port 3389

Once the new port works, disable the default rules:

Get-NetFirewallRule -DisplayGroup "Remote Desktop" | Where-Object Enabled -eq True | Format-Table DisplayName, Profile
Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

The built-in rules are tied to the default port; your custom rules from step 1 keep RDP working.

Verify

On the server:

Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq $port

From another machine:

Test-NetConnection 203.0.113.10 -Port 53389

TcpTestSucceeded : True means it’s reachable.

If you’re locked out

Log in through the VNC console in your VPS control panel — it works regardless of RDP settings — and either fix the firewall rule or set PortNumber back to 3389 and restart TermService.

Common causes:

  • The firewall rule for the new port was missing or applied to the wrong profile (use -Profile Any if in doubt).
  • A typo in the port number (or a hexadecimal value entered instead of decimal in regedit).
  • An external firewall or security group at the provider level still allows only 3389.

A port change is not enough on its own

Attackers scan all ports eventually. Combine the port change with real protections:

  1. Strong, unique passwords and no account named Administrator — rename it or create a new admin account.
  2. Network Level Authentication (NLA) enabled — the default on current Windows versions. See RDP Network Level Authentication.
  3. Account lockout policy so repeated guesses lock the account temporarily.
  4. Restrict RDP to known IP addresses in the firewall rule (-RemoteAddress 198.51.100.25), or put RDP behind a VPN such as WireGuard.
  5. Automatic blocking of IPs that fail repeatedly — see RDP brute-force protection.
  6. Windows Update kept current.

Windows 10 and 11

The same registry key, firewall commands and service restart apply to Windows 10/11 Pro and Enterprise. Home editions can’t host Remote Desktop sessions.

Need a Windows server for remote work, trading or automation? Our Windows VPS plans run Windows Server on KVM with a VNC console in the control panel, so changes like this are always recoverable.

  • Windows Server
  • RDP
  • Security