Skip to main content
To change the RDP port on Windows Server, first allow the new port (for example 3390) in Windows Defender Firewall with New-NetFirewallRule, then set PortNumber under HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp to the new value and restart the server. Connect afterwards with 203.0.113.10:3390. Remote Desktop listens on port 3389 by default. Do the firewall step first, or you lock yourself out.

​
Before you start

  • Sign in as an administrator with Remote Desktop.
  • Open the VNC console in a second browser tab and check that you can sign in there. If anything goes wrong, this is how you get back in. On a dedicated server without console access, open a ticket for KVM access before you start.
  • Pick a port between 1024 and 65535 that nothing else on the server uses. Check it is free:
No output means nothing is listening on 3390.
Changing the RDP port can lock you out. Always follow this order: 1. firewall rule, 2. registry, 3. restart, 4. test the new port, 5. only then remove the old rule. If you also filter traffic in the Firewall panel or another external firewall, allow the new port there first too.

​
Does changing the RDP port make the server secure?

Not by itself. A different port cuts down the noise from bots that only scan 3389, but anyone scanning all ports still finds RDP. Keep a strong password, Network Level Authentication and an account lockout policy, and limit RDP to your own IP where you can. See protect RDP from brute-force attacks.

​
How to change the RDP port with PowerShell

Open PowerShell as administrator: select Start, type PowerShell, right-click Windows PowerShell and choose Run as administrator.
1

Check the current port

The output shows PortNumber : 3389 on a default installation.
2

Allow the new port in Windows Firewall (first!)

Microsoft’s instructions add one TCP and one UDP rule for the new port (Microsoft Learn). -Profile Any makes the rule apply whichever network profile Windows has given your network adapter.
3

Check the rules exist

Both rules show Enabled True, Inbound, Allow.
4

Change the port in the registry

Run the first command again to confirm it now shows 3390.
5

Restart the server

Your Remote Desktop session ends. Wait one or two minutes for Windows to start again.
6

Connect on the new port

In Remote Desktop Connection, enter the IP address, a colon and the port, for example 203.0.113.10:3390.

​
How to change the RDP port in Registry Editor

If you prefer a window to PowerShell, still create the firewall rules from step 2 above first. Then:
1

Open Registry Editor

Select Start, type Registry Editor and open it.
2

Go to the RDP-Tcp key

Navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.
3

Edit PortNumber

Select PortNumber, then Edit > Modify. Select Decimal, type 3390 and select OK.
4

Restart

Close Registry Editor and restart the server.
Select Decimal before typing the port. If Hexadecimal is selected, 3390 is read as a hexadecimal number and RDP ends up on a different port.

​
How to check it worked

From your own computer, test the port before you connect (PowerShell on Windows):
TcpTestSucceeded : True means the port is open and Remote Desktop is listening. Then sign in with 203.0.113.10:3390. See also check if a port is open from outside. Once the new port works, you can close port 3389: run wf.msc, open Inbound Rules, sort by Local Port, then right-click each enabled Remote Desktop rule on port 3389 and choose Disable Rule. Enable them again if you ever change back.

​
What to do if you are locked out

  1. Open the VNC console and sign in as Administrator.
  2. Open PowerShell as administrator.
  3. Either add the missing firewall rule for the new port (step 2 of the PowerShell method), or set the port back to 3389 with the commands below. If you already disabled the port 3389 rules, enable them again in wf.msc first.
  4. Restart, then connect on 203.0.113.10 (port 3389) again.
If you can’t reach the console on a dedicated server, open a ticket.

​
Frequently asked questions

​
What is the default RDP port?

TCP and UDP 3389. Microsoft stores it in the PortNumber value of the RDP-Tcp registry key.

​
Do I have to restart the whole server?

Microsoft’s instructions end with a restart of the computer, so that is the reliable way to make Remote Desktop listen on the new port.

​
Which port should I choose?

Any free port from 1024 to 65535 that isn’t used by your software, for example 3390 or 33890. Avoid well-known ports such as 80, 443 or 1433, and ports your game server uses.

​
How do I connect on the new port from a Mac or phone?

Add the port to the PC name or address, for example 203.0.113.10:3390, in Windows App or the Remote Desktop client.

VPS and dedicated server guides

Every guide in this section.

Protect RDP from brute force

Lockout policy and IP limits.

Open a port in Windows Firewall

Inbound rules explained.

Fix Remote Desktop can't connect

Step-by-step checks.

Use the VNC console

Your way back in if RDP fails.
Checked against Microsoft Learn: Change the Remote Desktop listening port, New-NetFirewallRule and Test-NetConnection on 4 November 2026. Not tested on a live Windows server for this page.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026