Security

Change the Remote Desktop port safely

Open the new port in Windows Firewall first, change the RDP port in the registry, restart the service and connect on the new port.

IntermediateWindows server2 min read

On Windows VPS and Admin RDP servers, Remote Desktop already listens on TCP port 3389. Most people never need to change it. If you want a different port, for example to match a company policy, follow the steps below. The order matters: open the new port in the firewall first, then move RDP.

Warning: If you change the port before allowing it in the firewall, your next connection will fail. Keep the browser console from the control panel in mind as your way back in, and keep your current session open until you have tested the new port.

1. Pick a port

Choose an unused port between 1025 and 65535, for example 49833. Avoid ports used by software you run (such as 1433 for SQL Server or 8080 for web apps). This guide uses 49833.

2. Allow the new port in Windows Firewall

Open PowerShell as Administrator:

PowerShell
New-NetFirewallRule -DisplayName "RDP 49833 TCP" -Direction Inbound -Protocol TCP -LocalPort 49833 -Action Allow
New-NetFirewallRule -DisplayName "RDP 49833 UDP" -Direction Inbound -Protocol UDP -LocalPort 49833 -Action Allow

3. Change the RDP port

PowerShell
Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 49833
Get-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber

4. Restart the Remote Desktop service

Restarting the service ends your current session, so check step 2 once more first. Then run:

PowerShell
Restart-Service -Name TermService -Force

If the command reports that dependent services are running, restart the server instead with Restart-Computer.

5. Connect on the new port

Add the port after the IP address with a colon:

PowerShell
mstsc /v:203.0.113.25:49833

In Windows App on Mac, iPhone or Android, enter 203.0.113.25:49833 as the PC name.

6. Close the old port

Once the new port works, disable the rule that allows the old port (3389 by default):

PowerShell
Get-NetFirewallPortFilter -Protocol TCP |
  Where-Object LocalPort -eq 3389 |
  Get-NetFirewallRule |
  Disable-NetFirewallRule

Tip: If you later restrict RDP to your own IP address, apply the restriction to your new rules (for example Set-NetFirewallRule -DisplayName "RDP 49833 TCP" -RemoteAddress 198.51.100.10).

Troubleshooting

  • Timeout on the new port: open the browser console from the control panel, log in and check the rule with Get-NetFirewallRule -DisplayName "RDP 49833*".
  • Want to undo it: set PortNumber back to 3389, re-enable the 3389 rule (the same pipeline as step 6 with Enable-NetFirewallRule) and restart the service.

Next steps

Was this guide helpful?

Still stuck?

Ask MdmHost AI for a quick answer, or open a ticket and our team will take a look. We are here 24/7.

Ask MdmHost AIOpen a ticket

Related guides

Security

Set up a UFW firewall on Ubuntu and Debian

Set safe defaults, allow SSH before switching UFW on, open only the ports you use, limit sensitive ports to your own IP, and tidy up old rules.

3 min read
Security

Make iptables rules survive a reboot

iptables rules live in memory and disappear on reboot. Save them with netfilter-persistent on Debian and Ubuntu or iptables-services on AlmaLinux and Rocky Linux.

5 min read