Windows Server · Oct 21st 2026 · 7 Min readHow to Change RDP Port Number for a Windows Server?
Port 3389 is the first thing automated scanners hit when they find an exposed Windows Server. If your firm runs QuickBooks, Lacerte, Drake, or any other accounting software on a hosted Windows Server and connects via Remote Desktop, leaving RDP on its default port guarantees a steady stream of brute-force attempts in your logs. Changing the port won’t stop a determined attacker who scans every port, but it eliminates most opportunistic noise—and the whole job takes under ten minutes.
This guide covers two methods: manual Registry Editor editing and a PowerShell one-liner. Both apply to Windows Server 2016, 2019, and 2022. After either method, you must add a Windows Firewall inbound rule or the new port will be unreachable.
Before you start: Snapshot the registry or take a VM backup. Write down the new port number. Confirm you have a second path into the server—console access or an out-of-band tool—in case you lock yourself out. Do not skip this step.
Method 1: Edit the Registry Manually
- Press Win + R, type
regedit, press Enter. Accept the UAC prompt. - Navigate to:
“ HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp “
- Double-click the PortNumber DWORD value.
- In the Edit dialog, select Decimal.
- Replace
3389with your chosen port. Any number in the 1024–65535 range that is not already in use works. Avoid obvious ports like 80, 443, or 8080—scanners probe those too. - Click OK, then close Registry Editor.
- Restart the server. Microsoft requires a full reboot for the registry change to take effect—restarting only the Remote Desktop Services service is not sufficient per the official documentation.
Method 2: Change the RDP Port with PowerShell
Open PowerShell as Administrator. Run this command, substituting your port number for NEWPORT:
“powershell Set-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' -Name 'PortNumber' -Value NEWPORT “
Example—moving RDP to port 33890:
“powershell Set-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' -Name 'PortNumber' -Value 33890 “
Verify the write succeeded before doing anything else:
“powershell Get-ItemProperty -Path 'HKLM:SYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp' | Select-Object PortNumber “
The output should show your new port in decimal. If it still shows 3389, the command did not run with admin rights—check your session and retry.
Then restart Remote Desktop Services:
“powershell Restart-Service -Name TermService -Force “
PowerShell gives you a clean audit trail. If you’re managing multiple servers, wrap this in a script and run it remotely with Invoke-Command.
Open the New Port in Windows Firewall
Changing the registry alone is not enough. Windows Firewall still has an inbound rule that only allows TCP traffic on 3389. You need a new rule.
GUI method — Windows Defender Firewall with Advanced Security:
- Open Windows Defender Firewall with Advanced Security.
- Click Inbound Rules → New Rule.
- Select Port, click Next.
- Choose TCP, enter your new port number, click Next.
- Select Allow the connection. If you know your firm’s IP range, scope it here—this is more effective than port-changing alone.
- Apply to Domain, Private, and Public profiles as appropriate for your environment.
- Name the rule (e.g., “RDP Custom Port”) and finish.
- Optionally disable or delete the old rule for port 3389.
PowerShell method:
“powershell New-NetFirewallRule -DisplayName "RDP Custom Port" -Direction Inbound -Protocol TCP -LocalPort NEWPORT -Action Allow “
If your server sits behind a hardware firewall or a cloud security group, update that rule too. The Windows Firewall change means nothing if the upstream device is still blocking the new port or still forwarding 3389.
Connecting After the Change
Once the registry change is active and the firewall rule is in place, your RDP client needs the new port. In the standard Remote Desktop Connection client (mstsc.exe), append the port with a colon:
“ yourserver.example.com:NEWPORT “
or with an IP address:
“ 192.168.1.100:NEWPORT “
Test from a second machine before you close your current session. If the new connection fails, your fallback access method is what saves you. That is not a hypothetical—it happens.
Layering This Into a Real Security Posture
Port-changing is one layer, not a security strategy. For an accounting firm, here is what should sit alongside it:
- Network Level Authentication (NLA): Forces credential verification before a full RDP session opens. Enable it in System Properties → Remote Desktop settings.
- Source IP restrictions: A firewall rule that only allows connections from your firm’s known IP addresses cuts exposure far more than port obscurity alone.
- Account lockout policy: Set a threshold in Group Policy (e.g., lock after 5 failed attempts). This blunts brute-force attempts regardless of which port RDP is on.
- VPN or Zero Trust gateway: The most defensible posture is one where the RDP port is never directly internet-facing at all. Users connect to the VPN first, then RDP into the server.
- Document the new port. A 2 a.m. support call because a staff member can’t connect and no one wrote down the port number is a real, avoidable problem. Put it in your password manager or IT runbook.
Windows 11 Home Vs Pro For Accountants
How Sagenext Helps
Managing RDP ports, firewall rules, registry changes, and server hardening across multiple Windows Server instances is real work—work that competes with billable hours. For CPA firms and accounting practices that would rather not own this problem, Sagenext provides fully managed cloud hosting for tax and accounting software.
The hosted environment covers QuickBooks (Desktop, Enterprise, Premier, Pro), Sage 50, Sage 100, Lacerte, Drake, ProSeries, UltraTax, ATX, and others. Provisioning, backups, security configuration, and software updates are handled on your behalf. Staff access their applications via a remote desktop session from anywhere—without anyone at the firm needing to manage the underlying Windows Server configuration.
If you want to see how it works before committing, Sagenext offers a free trial with no credit card required.
Key Takeaways
- The RDP listening port lives at
HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcpunder thePortNumberDWORD value. - You can change it via Registry Editor or with a single
Set-ItemPropertyPowerShell command—both are Microsoft-documented methods. - After a Registry Editor change, a full server reboot is required; after PowerShell, restarting the
TermServiceservice is sufficient. - Changing the port without adding a Windows Firewall inbound rule for the new port will make RDP unreachable.
- Port obscurity reduces automated scan noise but must be layered with NLA, account lockout policies, and IP-restricted firewall rules.
- Always confirm a fallback access method before making the change—losing your only path into the server is a serious operational problem.
Frequently Asked Questions
What port should I use instead of 3389?
Any port in the 1024–65535 range that nothing else on that server is already using. Avoid well-known alternatives like 80, 443, 8080, or 3306—automated scanners probe those too. Many administrators use a high, non-obvious number like 33899 or 49172. The specific number matters less than ensuring it is unused on the server and open in your firewall.
Do I need to reboot the server after changing the RDP port?
Yes, if you used Registry Editor. Microsoft’s documentation states the computer must be restarted for the registry change to take effect. If you used the PowerShell Set-ItemProperty command, you can restart only the Remote Desktop Services (TermService) service with Restart-Service -Name TermService -Force, which avoids a full reboot.
Will changing the RDP port break existing connections?
Yes—any active RDP sessions will drop when you restart the service or the server. Plan the change during a maintenance window. Users will need to update their Remote Desktop Connection shortcuts to append the new port (e.g., server.domain.com:NEWPORT) before reconnecting.
Does changing the RDP port affect Group Policy or domain-joined servers?
Group Policy can override the registry value if a GPO sets the RDP port explicitly. After your change, verify the value held by running Get-ItemProperty on the registry key. If Group Policy is in play, you may need to configure the port change at the GPO level or create a GPO exception rather than editing the registry directly.
Is changing the RDP port enough to secure a server?
No. It reduces automated scan noise, but a full port scan will find the new port. Real protection requires Network Level Authentication, strong account lockout policies, source-IP firewall restrictions, and ideally a VPN or Zero Trust gateway so RDP is never directly internet-facing. Treat port-changing as one layer in a stack, not a standalone fix.
