Restore Remote Desktop to port 3389 after changing it

Windows VPS and Admin RDP servers accept Remote Desktop on TCP port 3389. If you or a script changed that port, Remote Desktop now listens somewhere else and the firewall may not allow it. This guide puts it back: set the port to 3389 in the registry, make sure the firewall allows it, restart the Remote Desktop service and reconnect.

Before you start

• Access to your VPS provider's control panel, where the server's control panel and browser console live.
• The server's Administrator (or admin user) password, also shown in your VPS provider's control panel if you have not changed it.
• About ten minutes.

If you can still connect on the new port, you can do every step below over Remote Desktop instead of the console. Do the firewall step first in that case, so you never lose both ports at once.

Open the browser console

1. Sign in to your VPS provider's control panel and open your Windows service.
2. Open the control panel and choose Console (the browser console).
3. If the screen is dark, click inside it and press a key. To reach the login screen, use the console's Ctrl+Alt+Del button, not your keyboard shortcut.
4. Sign in with your Windows username and password.
5. Right-click the Start button and choose Terminal (Admin) or Windows PowerShell (Admin), depending on your Windows version.

Check the current port

Run this to see which port Remote Desktop is set to use:

$rdp = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
Get-ItemProperty $rdp -Name PortNumber

If it already returns PortNumber: 3389, the port is not the problem. Skip to the firewall step and then see Check that Windows is listening on RDP port 3389.

Set the port back to 3389

Still in the same PowerShell window, set the value:

Set-ItemProperty $rdp -Name PortNumber -Value 3389 -Type DWord
Get-ItemProperty $rdp -Name PortNumber

The second line should now show PortNumber: 3389. PowerShell stores the number in decimal, so you do not need to convert it to hex as you would in Registry Editor.

If you prefer Registry Editor:

1. Press Win + R, type regedit and press Enter.
2. Go to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.
3. Double-click PortNumber, choose Decimal, enter 3389 and click OK.

Re-add the firewall rule

Check whether a rule already allows TCP 3389:

Get-NetFirewallPortFilter -Protocol TCP |
  Where-Object LocalPort -eq 3389 |
  Get-NetFirewallRule |
  Format-Table DisplayName, Enabled, Direction, Action

If the list is empty, or the rule shows Enabled False or Action Block, add an allow rule:

New-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)" `
  -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Allow

If an existing rule is disabled, you can enable it by name instead, for example Enable-NetFirewallRule -DisplayName "Remote Desktop (TCP 3389)".

You may also have a rule for the port you changed to. Leave it alone until you have reconnected on 3389, then remove it in the clean-up step.

Restart the Remote Desktop service

Windows reads the port number when the Remote Desktop Services service starts. Restart it:

Restart-Service -Name TermService -Force

-Force is needed because another service, the Remote Desktop Services UserMode Port Redirector, depends on it. Any open Remote Desktop sessions will drop, which is expected.

If the service does not come back, restart the whole server from your VPS provider's control panel instead. That always reloads the setting.

Check it works

1. Still in the console, confirm Windows listens on the right port:

   Get-NetTCPConnection -LocalPort 3389 -State Listen

You should see at least one line with LocalPort 3389 and State Listen.

1. From your own computer, test the port:

   Test-NetConnection 203.0.113.10 -Port 3389

1. Connect with Remote Desktop to 203.0.113.10:3389.

Clean up the old port

Once you are back in on 3389, remove any firewall rule you created for the other port, so it is not left open. List custom inbound rules to find it:

Get-NetFirewallRule -Direction Inbound -Enabled True |
  Where-Object DisplayName -like "*RDP*" |
  Format-Table DisplayName, Name

Then remove the old one by its display name, for example Remove-NetFirewallRule -DisplayName "RDP 50000". Double-check you are not deleting the 3389 rule.

Troubleshooting

• Get-NetTCPConnection shows nothing on 3389: the service did not reload the setting. Restart the server from your VPS provider's control panel and check again.
• Listening, but the port test from home fails: the firewall rule is missing or scoped to another IP. Check the rule's Scope tab in Windows Defender Firewall with Advanced Security.
• Console keyboard types the wrong characters: the console uses a US layout. Look out for \, | and ', which often land on different keys.
• Connected on 3389, but credentials fail: that is a separate issue. See Fix "Your credentials did not work".

Next steps

• Learn when the console is the right tool: When to use the browser console.
• Recover from other firewall mistakes: Fix a firewall lockout on Remote Desktop.