Check that Windows is listening on RDP port 3389

If a port test from outside fails, the next question is whether Windows is listening on TCP 3389 at all. This guide checks three things from inside the server: the configured port in the registry, the Remote Desktop service, and the live listening socket. When they disagree, you will know exactly what to fix.

Before you start

• A way into the server. If Remote Desktop is down, open the browser console from your VPS provider's control panel.
• An administrator account on Windows.
• PowerShell running as Administrator. Right-click Start and choose Terminal (Admin) or Windows PowerShell (Admin).

Check the configured port

Remote Desktop reads its port from the registry when its service starts:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber

Expected result:

PortNumber   : 3389

If you see any other number, someone changed it. Follow Restore Remote Desktop to port 3389 after changing it.

Also check that Remote Desktop connections are allowed at all:

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections

fDenyTSConnections: 0 means connections are allowed. 1 means Remote Desktop is turned off. You can turn it back on with:

Set-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections -Value 0

Check the Remote Desktop service

The service behind Remote Desktop is Remote Desktop Services, short name TermService:

Get-Service TermService, UmRdpService | Format-Table Name, Status, StartType

Both should show Running. TermService should normally have a start type of Manual or Automatic; Windows starts it when needed.

If it is stopped, start it:

Start-Service TermService

If it will not start, look in Event Viewer under Windows Logs → System for errors from the Service Control Manager or TermService. See Read Event Viewer logs on Windows Server.

Check what is listening

Now check the live socket. With PowerShell:

Get-NetTCPConnection -LocalPort 3389 -State Listen |
  Format-Table LocalAddress, LocalPort, State, OwningProcess

You should see one or two lines (for IPv4 0.0.0.0 and IPv6 ::), all in state Listen.

The classic netstat command shows the same thing and works in Command Prompt too:

netstat -ano | findstr :3389

Expected output looks like:

  TCP    0.0.0.0:3389          0.0.0.0:0              LISTENING       1188
  TCP    [::]:3389             [::]:0                 LISTENING       1188

The last number is the process ID (PID). Confirm it belongs to Remote Desktop:

Get-CimInstance Win32_Service -Filter "Name='TermService'" |
  Select-Object Name, ProcessId

The ProcessId should match the PID from netstat. Remote Desktop runs inside a shared svchost.exe process, so the process name alone is not enough to identify it.

Fix mismatches

Compare the three results and act on the first one that is wrong:

• Registry is not 3389: set it back and restart the service. See Restore Remote Desktop to port 3389.
• Registry is 3389, but nothing listens: the service has not picked up the setting, or it is stopped. Restart it:

  Restart-Service TermService -Force

This drops any open Remote Desktop session, including yours, so run it from the browser console if you can.

• Something else owns port 3389: if the PID belongs to another program, that program grabbed the port first. Find it with Get-Process -Id 1188 (use your PID), reconfigure or stop it, then restart TermService.
• Everything is correct, but outside tests still fail: Windows is listening, so check the firewall rule for 3389 next. See Allow RDP port 3389 in Windows Firewall.

If the service still refuses to start, restart the whole server from your VPS provider's control panel. A full reboot clears most stuck states.

Check it works

Test the port from the server itself first. This skips the network and the external firewall path:

Test-NetConnection 127.0.0.1 -Port 3389 -InformationLevel Quiet

True means Remote Desktop accepts connections locally. Then test from your own computer:

Test-NetConnection 203.0.113.10 -Port 3389

If the local test passes and the remote test fails, the cause is the firewall or the network between you and the server.

Troubleshooting

• Get-NetTCPConnection returns an error "No matching MSFT_NetTCPConnection objects": nothing is listening on 3389. Work through the registry and service checks above.
• Listening only on :: (IPv6): that is normal on many systems. The :: socket also accepts IPv4 on dual-stack Windows. Test with the IPv4 address to be sure.
• TermService stops again right after starting: a broken certificate or corrupt system file can cause this. Check the System log, then see Repair Windows with SFC and DISM.
• Listening and firewall open, but login fails: the network side is fine. Check the username and password from your VPS provider's control panel.

Next steps

• Test from outside: Test whether RDP port 3389 is reachable.
• General connection fixes: Fix Remote Desktop can't connect.