RDP port 3389: which port Remote Desktop uses and how to change it

3389 is the default on every edition of Windows that can accept Remote Desktop connections. If UDP is blocked, Remote Desktop still works over TCP alone. A gateway is something companies run; at home you'll only deal with 3389. If Remote Desktop isn't switched on yet, start with how to enable Remote Desktop on Windows 11 and 10.

On Windows 11, open Settings, then System, then Remote Desktop: the page shows the Remote Desktop port. On Windows 10 (or to be sure on either), read it from the registry in PowerShell:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber

PortNumber : 3389 means the default. To see whether Remote Desktop is actually waiting for connections, run this in Command Prompt on the same PC. A line ending in LISTENING means it is:

netstat -an | findstr 3389

From another PC on the same network, test that the port answers. Put in the PC's name or local IP address; TcpTestSucceeded : True means it can be reached:

Test-NetConnection -ComputerName office-pc -Port 3389

Whether it's reachable from the internet is a different question. Run our open port checker from a device on that network: it checks 3389 on your own connection and nothing else.

You need an administrator account on the PC. Do this while you're at the PC, or keep another way in: if the firewall rule is wrong, Remote Desktop stops answering and you can't fix it over Remote Desktop.

1. 1

   Step 1: Pick a new port

   Choose an unused number between 1025 and 65535, such as 3390 or 50123. Avoid ports other programs on the PC already use.

2. 2

   Step 2: Change PortNumber in the registry

   Open Registry Editor and go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp, double-click PortNumber, choose Decimal, type the new port and click OK. Or run this in PowerShell as administrator:

   Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value 3390

3. 3

   Step 3: Allow the new port through Windows Firewall

   The firewall rules Windows made for Remote Desktop only cover 3389. Add rules for the new port in PowerShell as administrator:

   New-NetFirewallRule -DisplayName "Remote Desktop TCP 3390" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow -Profile Private
   New-NetFirewallRule -DisplayName "Remote Desktop UDP 3390" -Direction Inbound -Protocol UDP -LocalPort 3390 -Action Allow -Profile Private

   Private covers a home network set to Private. Use Domain on a company network, or leave -Profile out to allow it on every type of network.

4. 4

   Step 4: Restart the PC

   Remote Desktop picks up the new port when Windows starts again.

5. 5

   Step 5: Connect with the new port

   In Remote Desktop Connection, type the PC's name or address, a colon and the port, for example office-pc:3390 or 192.168.1.20:3390. If it won't connect, check the firewall rules first, then the other fixes in Remote Desktop not working.

Your router drops connections that arrive from the internet unless a port forwarding rule tells it which device they're for. To reach Remote Desktop from outside your network, people usually:

• Give the PC a fixed local address, with a DHCP reservation on the router, so the rule keeps pointing at it.
• Add a port forwarding rule on the router: TCP 3389 (and UDP 3389) to that local address. Many routers let you pick a different outside port, like 50123, that leads to 3389 on the PC.
• Connect from outside with the network's public IP address and the outside port, like 203.0.113.7:50123.

It often doesn't work even when it's set up right. If your internet provider shares one public address between customers (common on 4G, 5G and satellite internet), nothing can be forwarded at all; see remote access behind CGNAT, 4G/5G and Starlink. And when the public address changes, the connection breaks until you look up the new one.

A forwarded Remote Desktop port is open to everyone on the internet, not just you:

• Automated scanners look for open Remote Desktop ports around the clock and try common user names and passwords against them.
• The PC's own sign-in becomes the only thing between it and the internet, so one weak or reused password is enough.
• Serious Remote Desktop flaws have turned up before; one found in 2019 let attackers into older, unpatched versions of Windows without any password.
• Exposed Remote Desktop is a well-known way into small business networks for ransomware.

If you do forward it, keep the damage small:

• Keep Network Level Authentication on (Settings, System, Remote Desktop), so nobody gets a session before signing in.
• Use a long, unique password on every account that's allowed to sign in, and remove accounts that don't need Remote Desktop.
• Install Windows updates promptly.
• In the firewall rule's Scope tab, allow only the addresses you connect from, if they're fixed.
• Remove the forwarding rule as soon as you no longer need it, then confirm with the port checker that 3389 is closed.

If you're worried someone already got in, the checks in how to tell if someone is remotely accessing your computer include reading Windows' log of Remote Desktop sign-ins.

The protocol itself is encrypted: Remote Desktop sessions use TLS, and with Network Level Authentication you have to sign in before Windows starts a session at all. The usual problem isn't the encryption, it's exposure. A PC that answers on 3389 to the whole internet can be attacked by anyone, around the clock. Kept on your own network, with good passwords and updates, Remote Desktop is a reasonable way to use another PC.

Use a remote access app that connects out

RemoteAccessApp runs a small app on the PC that makes an outgoing connection to our relay, and your app or browser does the same, so there's no port to forward and nothing new for scanners to find. It also works on Windows Home, which can't accept Remote Desktop at all, and on Linux. The PC asks before anyone connects, unless you switched on unattended access at that PC, and shows a banner for the whole session. How that works is in remote desktop without port forwarding, and free remote desktop for Windows covers the rest.

Keep using Remote Desktop, with 3389 closed on the router

If you'd rather keep Remote Desktop for a machine, the RemoteAccessApp app keeps saved Remote Desktop connections in tabs (see the RDP and VNC connection manager). Set one to connect through another of your PCs on the same network: that PC opens the connection on its network, and everything travels through our relay, so the router doesn't forward anything. Someone at that PC is asked to allow it, unless unattended access lets you in. The help article on how to connect through one of your PCs has the steps.