How to Change RDP Port Number for a Windows Server?

Port 3389 is the first thing automated scanners probe when they find an exposed Windows Server. If your firm hosts QuickBooks, Lacerte, or any other accounting software on a Windows Server and uses Remote Desktop to connect, leaving RDP on its default port is an open invitation for brute-force attempts. Changing the port does not replace real security controls, but it eliminates a massive volume of opportunistic noise—and it takes under ten minutes.

This guide covers two methods: manual Registry editing and a PowerShell one-liner. Both work on Windows Server 2016, 2019, and 2022. After either method, you must update your Windows Firewall rule or the new port will be unreachable.

Before you start: Take a registry backup or snapshot. Write down the new port number. Make sure you have a second way into the server—console access or an out-of-band management tool—in case you lock yourself out.

---

---

Method 1A — Change the RDP Port Manually in Registry Editor

1. Press Win + R, type regedit, press Enter. Accept the UAC prompt.
2. Navigate to:

“ HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp “

3. Double-click the PortNumber DWORD value.
4. In the Edit dialog, select Decimal.
5. Replace 3389 with your chosen port. Pick any number in the 1024–65535 range that is not already in use on that server. Avoid well-known ports like 80, 443, or 8080.
6. Click OK, then close Registry Editor.
7. Restart the Remote Desktop Services service (or reboot the server) for the change to take effect.

---

---

Method 1B — Change the RDP Port with PowerShell

Open PowerShell as Administrator and run a single command, substituting your chosen port number for NEWPORT:

“powershell Set-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' -Name 'PortNumber' -Value NEWPORT “

Example — moving RDP to port 33890:

“powershell Set-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' -Name 'PortNumber' -Value 33890 “

Verify the change was written correctly:

“powershell Get-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' | Select-Object PortNumber “

The output should show your new port in decimal. Then restart the Remote Desktop Services:

“powershell Restart-Service -Name TermService -Force “

---

---

Method 2 — Update Windows Firewall for the New Port

Changing the registry alone is not enough. Windows Firewall still has a rule allowing inbound traffic only on 3389. You need a new rule for your new port.

Option A — Windows Defender Firewall GUI:

1. Open Windows Defender Firewall with Advanced Security.
2. Click Inbound Rules → New Rule.
3. Select Port, click Next.
4. Choose TCP, enter your new port number, click Next.
5. Select Allow the connection, scope it to trusted IP ranges if possible.
6. Apply to Domain, Private, and Public profiles as appropriate.
7. Name the rule (e.g., “RDP Custom Port”) and finish.
8. Optionally, disable or delete the old rule for port 3389.

Option B — PowerShell:

“powershell New-NetFirewallRule -DisplayName "RDP Custom Port" -Direction Inbound -Protocol TCP -LocalPort NEWPORT -Action Allow “

If your server sits behind a hardware firewall or a cloud security group (common in hosted environments), update that rule too—otherwise the firewall closest to the internet will still block the new port.

---

---

Connecting After the Change

Once the registry change and firewall rule are both active, your RDP client needs to know the new port. In the standard Remote Desktop Connection client (mstsc.exe), append the port with a colon:

“ yourserver.example.com:NEWPORT “

Test from a second machine before ending your current session. If the connection fails, your fallback access method becomes critical—this is why console access matters before you start.

Microsoft

---

---

Practical Security Notes

• Changing the port reduces automated scan noise but does not stop a determined attacker who port-scans the full range. Layer this with Network Level Authentication (NLA), strong passwords, and account lockout policies.
• For accounting firms, restrict RDP access by source IP wherever possible. A firewall rule that only allows connections from your firm’s known IP addresses is far more effective than port obscurity alone.
• Consider pairing RDP access with a VPN or Zero Trust gateway so the RDP port is never directly internet-facing at all.
• Document the new port number somewhere your team can find it. A late-night support call because no one remembered the custom port is a real and avoidable problem.

Windows 11 Home Vs Pro For Accountants

---

---

How Sagenext Helps

If managing RDP ports, firewall rules, and server hardening feels like a distraction from client work, that is a fair read of the situation. Sagenext provides fully managed cloud hosting for accounting and tax software—QuickBooks Desktop, QuickBooks Enterprise, Sage 50, Sage 100, Drake, Lacerte, ProSeries, UltraTax, ATX, and others. Infrastructure security, remote access configuration, software updates, and data backups are handled on your behalf.

For a 10-person CPA firm, this matters because server administration time compounds fast. Every hour spent on port rules and patch cycles is an hour not spent on client work. With hosted accounting software, your team connects through a managed remote session without your staff needing to own the underlying Windows Server configuration at all.

Sagenext offers a free trial with no credit card required.

---

---

Key Takeaways

• The default RDP port is 3389; changing it reduces automated brute-force attempts but must be combined with stronger controls like NLA and IP restrictions.
• You can change the port via Registry Editor (manual) or a PowerShell Set-ItemProperty command—both edit the same registry key under HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp.
• Always update the Windows Firewall inbound rule to allow traffic on the new port, and allow time to update any upstream firewall or security group as well.
• Restart Remote Desktop Services after the registry change or the new port will not be active.
• Keep a backup access method (console, out-of-band) before making the change so a misconfiguration does not lock you out entirely.
• For accounting firms that want RDP and server management handled for them, managed cloud hosting removes the need to perform these steps at all.

---

---

Frequently Asked Questions

What is the default RDP port number for Windows Server?

The default RDP listening port is 3389 on all modern Windows Server versions, including 2016, 2019, and 2022. This is the port the Remote Desktop Services role listens on unless it has been manually changed in the registry. Because 3389 is universally known, it is a common target for automated scanning and brute-force login attempts.

Will changing the RDP port break anything on my server?

It will not break the server itself, but it will break any existing RDP client shortcuts or firewall rules that reference port 3389. Update your Windows Firewall inbound rule to allow the new port, update any upstream firewall or cloud security group rules, and update your mstsc connection strings to include the new port number. Test the new connection before closing your existing session.

Do I need to restart the server after changing the RDP port?

A full server reboot works, but it is not always necessary. Restarting just the Remote Desktop Services (TermService) is usually sufficient and faster. In PowerShell: Restart-Service -Name TermService -Force. Either way, the service restart is required—the change is not active until the service reloads the registry value.

What port range should I use for a custom RDP port?

Use a port in the 1024–65535 range to avoid conflicting with system-reserved ports (0–1023). Check that the port is not already in use on your server with netstat -an | findstr LISTENING before committing to it. Avoid obvious substitutes like 3388 or 3390—scanners often probe those too.

Can I change the RDP port remotely without losing my connection?

Yes, with care. Make the registry change and firewall update while connected on port 3389. Open a second RDP session on the new port to verify it works before closing the first. Do not restart the TermService until the second session is confirmed active, or have console/out-of-band access ready as a fallback.