Changing the RDP port from 3389: what it fixes and what it doesn't

The honest summary

Moving RDP off 3389 will cut your failed-login volume by something like 90% overnight. It is also not a security control, and treating it as one is how servers get compromised by administrators who thought they were finished.

Both statements are true because they answer different questions. The volume drop is real, measurable and useful. The protection is close to zero against anyone who spends thirty seconds looking.

Worth doing? Usually yes — as noise reduction, in addition to a defence, never instead of one.

What it genuinely stops

The overwhelming majority of RDP attack traffic comes from untargeted scanners doing one thing: connecting to port 3389 across large IP ranges and trying passwords on whatever answers. They do not port-scan. Scanning 65,535 ports on every address costs orders of magnitude more than checking one, and there are enough machines on 3389 that there is no reason to bother.

Move to 34519 and you drop out of that population entirely. The graph falls off a cliff, the Security log stops rotating every few hours, and finding a real event in it becomes possible again.

That last point is the underrated benefit. An event log you can actually read is worth real money during an incident, and at three thousand failures a day you do not have one.

What it does not stop

Anyone who scans the full port range finds you in minutes. RDP is trivially identifiable from its handshake regardless of which port it sits on, so a scanner sweeping all ports and fingerprinting what answers will label your service correctly the first time.

Shodan and Censys do exactly this continuously, across the whole internet, and publish the results as a searchable index. Your non-standard RDP port is in there, findable by anyone, within days of you opening it.

So against an untargeted bot, moving the port works. Against anyone who chose you — a competitor, a former employee, a ransomware operator working through a list of a sector's companies — it costs them a few minutes. And it does nothing at all about weak passwords, exposed SMB, an unpatched host, or credentials that leaked somewhere else.

There is one active downside too: obscure ports break things. Corporate firewalls that permit outbound 3389 will block outbound 34519, and you will find that out from a user who cannot work.

How to change it without locking yourself out

The port lives in the registry, and Windows Firewall must be told about it before you restart the service — in that order, or you will disconnect yourself from a machine you can only reach over RDP.

Pick a port above 10000 that nothing else uses, verify it is free, open it, then change it:

$NewPort = 34519

# 1. Confirm nothing is already listening there.
Get-NetTCPConnection -LocalPort $NewPort -ErrorAction SilentlyContinue

# 2. Open it in the firewall FIRST — before the service moves.
New-NetFirewallRule -DisplayName "RDP-$NewPort" -Direction Inbound `
  -Protocol TCP -LocalPort $NewPort -Action Allow

# 3. Point Terminal Services at the new port.
Set-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' `
  -Name PortNumber -Value $NewPort

# 4. Restart the service (this drops your current session).
Restart-Service TermService -Force

Afterwards

Connect on the new port explicitly — mstsc /v:server:34519 — and update anything that stored the old one: saved RDP files, bookmark managers, monitoring checks, jump-host configs, your team's documentation. Then remove or narrow the old 3389 allow rule, or you have gained nothing.

Do not delete the old rule before confirming the new port works from outside your network. Inside the LAN everything works either way, which is exactly how people convince themselves it is fine.

What to pair it with

Port changes reduce noise. Something still has to handle the attempts that arrive — and after a port change, the attempts that arrive are the ones from someone who looked for you specifically, which are the ones you actually care about.

That means the same three things as before: watch failed logons, ban sources that cross a threshold, and never let a ban catch you. RDP Protector detects the real RDP port from the registry and the listening sockets rather than assuming 3389, so a server that has been moved is covered without configuring anything — and it rebuilds its rules automatically if the port changes again later.

Change the port for a readable log. Keep a defence for the traffic that finds you anyway.