Why Change the RDP Port?
By default, the Windows Remote Desktop Protocol (RDP) listens on TCP port 3389. Because this is a universally known standard, any Windows Server exposed to the internet will be bombarded by thousands of automated brute-force login attempts every single day from botnets scanning for port 3389. While changing the port is technically “security by obscurity” and does not replace a strong VPN or firewall, changing the default port to a random high number (like 48291) drastically reduces the amount of background noise and automated attacks hitting your server’s event logs.
Step 1: Open the Registry Editor
The RDP port is deeply embedded in the Windows Registry. You must be an Administrator to change it.
Click the Start button, type regedit, and press Enter to open the Registry Editor.
Step 2: Navigate to the RDP-Tcp Key
In the left-hand pane of the Registry Editor, carefully drill down through the tree to the following exact path:
HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
Warning: Be extremely careful not to modify any other keys while in this section of the registry.
Step 3: Modify the PortNumber Value
With the RDP-Tcp key selected, scroll down the right-hand pane until you find the DWORD value named PortNumber.
Double-click PortNumber. In the Edit window, it is critical that you first change the Base radio button from Hexadecimal to Decimal.
The Value data will now display as 3389. Change this to your desired new port number. It must be an unused port between 1025 and 65535. For this example, type 48291. Click OK.
Step 4: Update the Windows Firewall
You have instructed the RDP service to listen on the new port, but the Windows Defender Firewall is currently blocking it. You must create a new Allow rule before you reboot, or you will lock yourself out of the server!
Open Windows Defender Firewall with Advanced Security. Click on Inbound Rules in the left pane, and select New Rule… in the right pane.
Select Port > TCP > Specific local ports: 48291.
Choose Allow the connection, apply it to all profiles (Domain, Private, Public), and name the rule “Custom RDP Port 48291”.
Step 5: Restart the Service and Connect
For the registry change to take effect, you must restart the Remote Desktop Services service, or simply reboot the entire server.
To connect to the server from your client machine, open the Remote Desktop Connection app (mstsc.exe). You must now explicitly append the new port number to the IP address or hostname using a colon.
For example, instead of typing 192.168.1.50, you must type:
192.168.1.50:48291
Your RDP connection is now completely hidden from standard automated port 3389 scanners.