Key Points
- To change the port in the registry, edit the PortNumber value under HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp and use the Decimal base.
- Update Windows Firewall by creating an inbound TCP rule for the new port.
- Verify the change and confirm that the new port shows a LISTENING status with netstat.
- Connect with the new port by entering the hostname or IP address, a colon, and the port.
- As a best practice, keep strong authentication and firewall controls in place.
Remote Desktop Protocol (RDP) is a reliable networking and troubleshooting tool for IT administrators. However, admins must first build proper security arrangements around it to ensure the connection cannot be exploited.
One way to do this is by changing the Remote Desktop port on networked devices. This simple switch helps secure a vulnerable entry point and streamline protocols across any managed environment. Follow along this guide to see how these settings can be configured and validated soon after.
Prefer video? Watch our step-by-step guide: How to Change Remote Desktop Port in Windows 11.
Prerequisites and method for changing the Remote Desktop port
Before making any changes, take note of these system and access requirements for smooth deployment and testing.
✔️ You must be signed in with administrator privileges.
✔️ Ensure Remote Desktop is enabled.
✔️ Support multiple RDP endpoints behind a shared IP.
✔️ Comply with organizational security policies.
✔️ Familiarity with Registry Editor interface and functionalities.
Warning: Unintended changes to the Windows Registry can affect your system’s performance and stability. Learn how to back up the Registry and create a restore point before configuring the database.
Change RDP port via Registry Editor
To complete this action, you will need to modify the Windows Registry. To familiarize yourself with the Registry database, check out our interactive video on how to use the Registry Editor.
Otherwise, you may refer to these steps to continue:
- Press Win + R, type regedit, and tap OK to open the Registry Editor.
- Navigate to or copy and paste the following path to the Registry address bar: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
- On the right pane, find the PortNumber DWORD value.
- Double-click it and select Modify.
- Under Base, choose Decimal and replace the value from 3389 (default) to your desired port (e.g., 3390, 443, 50001)
- Click OK to confirm and close Registry Editor.
You may need to restart the system or the Remote Desktop service to apply the changes.
The next time you connect to this device by using the Remote Desktop Connection, enter the hostname along with the updated port number.
Update Windows Firewall for New RDP Port
After changing the port, it’s essential to update the firewall settings to acknowledge the new port and permit connections. To do this, you can create a new Inbound Rule.
- From Windows Search, open Windows Defender Firewall with Advanced Security.
- Click Inbound Rules and click on New Rule… to open the New Inbound Rule Wizard.
- Under Port Type, toggle the Port option, then click Next.
- Choose TCP, enter the new port into the Specific local ports field, and click Next.
- Toggle Allow the connection, click Next, and apply the rule to all profiles.
- Set a name for the rule (e.g., RDP Custom Port) and tap Finish to confirm and exit.
After setup, test the RDP connection by using the new port. If the connection fails, make sure that the rule is active and correctly configured to allow TCP traffic on the designated port.
Confirm that the new port is active or listening
In Command Prompt or PowerShell, use the netstat -an | findstr :<your-port> command to verify if the new port is open and listening.
Example:
netstat -an | findstr :3389 3390
You should see the LISTENING status if the change was successful.
Changing the RDP port: Additional considerations and tips
Changing the port adds obscurity, but it should not be treated as a replacement for strong authentication and firewall protocols. Keep those settings up to standard and consider these additional pointers to enforce your new settings and maximize the use of RDP.
- RDP Clients: When connecting via the new port, use: <hostname or IP>:<port>.
- Port Range: Choose a non-conflicting, unused port above 1024 and below 65535.
- Router/NAT Port Forwarding: If you are accessing the machine remotely over the Internet, configure your router to forward the new RDP port.
- RDP sessions can lock the remote desktop, making it ideal for managing endpoints but less so for collaboration.
Note: Unfortunately, there is no direct GPO that controls RDP port changes. As a result, IT managers must rely on the registry or scripting for mass deployments.
Best practices for configuring Remote Desktop Port
Leaving the default settings unchecked is a big risk for IT environments. These configurations are no secret to advanced users and hackers, which renders your system vulnerable and raises internal compliance concerns.
The Remote Desktop service is a powerful and essential tool for IT administrators, so configuring its settings should be one of the key priorities when boosting network security. You can learn more ways on how to use RDP on our blog or check out NinjaOne Remote® to discover advanced integration for remote access management.
