WindowsUpdated April 18, 2026 · 27,890 views

How to change the RDP port on Windows Server

Registry change, firewall rule and verification — three commands and a reboot.

Why

Port 3389 is scanned continuously across the entire IPv4 space. Moving to a high random port removes you from every mass-scan target list. It is not a substitute for a firewall rule, but it costs nothing.

Change it

$port = 53389
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber -Value $port
New-NetFirewallRule -DisplayName "RDP-Custom-TCP" -Direction Inbound -Protocol TCP -LocalPort $port -Action Allow
New-NetFirewallRule -DisplayName "RDP-Custom-UDP" -Direction Inbound -Protocol UDP -LocalPort $port -Action Allow
Restart-Computer

Connect afterwards

mstsc → your.server.ip:53389

Do not remove the old rule firstKeep the 3389 rule until you have confirmed the new port works. If both fail, use the VNC console in the client area to undo the registry change.

Verify

Get-NetTCPConnection -State Listen | Where-Object LocalPort -eq 53389
Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber

Did this solve your problem?

If not, open a ticket and paste the command output you got. Support is 24/7 with a 12-minute median first reply, and the same engineers maintain these pages.

Open a ticket Back to knowledge base