Boost Windows Security: A Step-by-Step Guide to Changing the RDP Port

As a seasoned system administrator, I’ve seen my fair share of security breaches and unauthorized access attempts on Windows servers. One simple yet effective way to enhance server security is to change the default Remote Desktop Protocol (RDP) port. In this article, I’ll walk you through the reasons behind changing the RDP port, the methods for doing so, and provide some practical advice on implementing this security measure.

Remote Desktop Protocol (RDP) is a widely used protocol for remote access to Windows servers. By default, RDP listens on TCP port 3389, a well-known port that’s often targeted by malicious actors and brute-force attacks. While changing the RDP port is not a substitute for robust security measures, it can help reduce the attack surface and prevent unauthorized access to your Windows servers.

At OwnWebServers, we offer managed Windows servers and cloud infrastructure, where RDP port customization may be part of the initial server setup or configuration. In this article, I’ll focus on the process of changing the RDP port in Windows Server 2025, providing you with the knowledge and tools to enhance your server security.

Why Change the Default RDP Port?

The default RDP port, 3389, is a well-known port that’s often targeted by malicious actors. By changing the RDP port, you can reduce the risk of unauthorized access and prevent brute-force attacks. It’s worth noting that this is not a foolproof security measure, but rather an additional layer of protection that can help deter malicious activity.

Default RDP Port and Security Risks

Using the default RDP port can expose your Windows servers to various security risks, including:

• Brute-force attacks: Malicious actors can use automated tools to try different login credentials, attempting to gain access to your server.
• Denial of Service (DoS) attacks: By targeting the default RDP port, attackers can flood your server with traffic, causing it to become unavailable.

Methods for Changing the RDP Port

There are three methods for changing the RDP port in Windows Server 2025: editing the Windows Registry, using Windows PowerShell, or using the Netsh utility. Each method has its own advantages and disadvantages, which I’ll outline below.

Editing the Windows Registry

To change the RDP port using the Windows Registry, follow these steps:

1. Open the Registry Editor (regedit.exe) as an administrator.
2. Navigate to the following key: HKEY_LOCAL_MACHINESystemCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp.
3. Double-click on the PortNumber value and enter the new port number.
4. Click OK to save the changes.

Note: Be careful when editing the Windows Registry, as incorrect changes can cause system instability or crashes.

Using Windows PowerShell to Change the RDP Port

To change the RDP port using Windows PowerShell, run the following command:

Set-ItemProperty -Path "HKLM:SystemCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp" -Name "PortNumber" -Value <NewPortNumber>

This method is a bit more straightforward than editing the Registry, but still requires administrative privileges.

Changing the RDP Port with the Netsh Utility

To change the RDP port using the Netsh utility, run the following command:

netsh interface portproxy add v4tov4 listenport=<NewPortNumber> connectport=3389 connectaddress=127.0.0.1

This method is a bit more complex, but provides an additional layer of configuration options.

Configuring Firewalls for the New RDP Port

After changing the RDP port, you’ll need to configure your firewalls to allow incoming traffic on the new port. This is crucial to ensure that you can still access your server remotely.

Allowing Incoming Traffic on the New Port

To configure the Windows Defender Firewall, follow these steps:

1. Open the Windows Defender Firewall with Advanced Security.
2. Create a new inbound rule:
   1. Select “Rule Type” as “Port” and click Next.
   2. Select “TCP” and enter the new port number in the “Specific local ports” field.
   3. Click Next and select “Allow the connection” and click Next.
   4. Choose the network types and click Next.
   5. Name the rule and click Finish.

Best Practices for RDP Port Customization

When changing the RDP port, keep the following best practices in mind:

• Use a non-standard port number to reduce the risk of brute-force attacks.
• Ensure that any firewalls are configured to allow incoming traffic on the new port.
• Update any existing remote desktop connections, scripts, or automation tools to reflect the new port number.
• Consider implementing additional security measures, such as multi-factor authentication and IP restrictions.

Troubleshooting

Conclusion

Changing the RDP port in Windows Server 2025 is a simple yet effective way to enhance server security. By following the methods outlined in this article and implementing best practices for RDP port customization, you can reduce the risk of unauthorized access and prevent brute-force attacks. Remember to configure your firewalls to allow incoming traffic on the new port and update any existing remote desktop connections, scripts, or automation tools to reflect the new port number.

Frequently Asked Questions