How to change the Remote Desktop (RDP) port on Windows Server

Remote Desktop listens on port 3389, and bots try passwords on that port all day. Moving it to another port does not replace a strong password, but it cuts almost all automated login attempts. This guide works on Windows Server 2012 R2, 2016, 2019, 2022 and 2025.

Before you start: keep Open console on your VPS page at hand. If Remote Desktop stops answering, you can always log in there and undo the change.

1. Pick a port

Choose a number between 1024 and 65535 that nothing else uses, for example 33890. This guide uses 33890; replace it with yours everywhere.

2. Change the port and open the firewall

Open PowerShell as administrator (open the Start menu, type PowerShell, right-click Windows PowerShell and choose Run as administrator) and run these three commands, one at a time:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 33890

New-NetFirewallRule -DisplayName 'Remote Desktop 33890 TCP' -Direction Inbound -Protocol TCP -LocalPort 33890 -Action Allow

New-NetFirewallRule -DisplayName 'Remote Desktop 33890 UDP' -Direction Inbound -Protocol UDP -LocalPort 33890 -Action Allow

The first command changes the port, the other two allow it in the Windows firewall. The UDP rule is optional but makes Remote Desktop smoother.

3. Restart Remote Desktop

Restart-Service TermService -Force

Your current Remote Desktop session disconnects; that is expected. If the command reports an error, restart the whole server instead with Restart-Computer.

4. Connect on the new port

Add the port after the IP address with a colon:

• Windows (Remote Desktop Connection, mstsc): YOUR-SERVER-IP:33890
• macOS (Windows App): add a PC with YOUR-SERVER-IP:33890
• Linux: xfreerdp /v:YOUR-SERVER-IP:33890 /u:Administrator

5. Close the old port

Once you can connect on the new port, remove the old rule so 3389 is no longer reachable. In PowerShell as administrator:

Disable-NetFirewallRule -DisplayGroup 'Remote Desktop'

This turns off the built-in rules for port 3389 and keeps the ones you created for your new port.

Check the setup

To see which port Remote Desktop uses:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber

To see that it is listening:

netstat -an | findstr 33890

It should show a line with LISTENING.

Cannot connect?

Click Open console on your VPS page and log in. Then either allow the port again:

New-NetFirewallRule -DisplayName 'Remote Desktop 33890 TCP' -Direction Inbound -Protocol TCP -LocalPort 33890 -Action Allow

or go back to the default port:

Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 3389
Enable-NetFirewallRule -DisplayGroup 'Remote Desktop'
Restart-Service TermService -Force

Go further

• Use a long, unique password for Administrator: at least 12 characters with letters, numbers and symbols.
• Allow only your IP:
• Lock out repeated failures: in Local Security Policy (secpol.msc), under Account Policies, Account Lockout Policy, set an account lockout threshold, for example 10 invalid attempts.