Change the RDP port on Windows without rebooting the server

This guide shows you how to change the Remote Desktop port (RDP) on Windows with PowerShell, for example on a Windows Server, how to adjust the Windows firewall to match and how to restart the Remote Desktop service. A reboot of the whole server is not required for this.

Why you should change the RDP port

The default port for Remote Desktop is TCP 3389, and that is exactly the port automated bots scan around the clock. Any Windows server sitting on the internet with port 3389 open collects hundreds of failed sign-in attempts within hours. This does not only put load on the system, it also gets your own account locked out whenever a lockout policy is active.

A different port takes your server out of these mass scans. It does not replace any of the other safeguards, though: a strong password, Network Level Authentication (NLA) enabled and a firewall rule that limits RDP to your own IP address remain just as important.

Requirements

• A Windows system with Remote Desktop enabled, for example Windows Server 2022 or Windows Server 2025
• Administrator rights on that system
• A free port above 1024, in this example we use 33445
• Access to the KVM console in your customer panel as a way back in, in case the connection does not work straight away after the change

Open PowerShell as administrator

First open Windows PowerShell as an administrator. To do so, right-click "Windows PowerShell" in the start menu and select "Run as administrator". Without elevated rights the script is allowed to change neither the registry nor the firewall.

The PowerShell script for changing the RDP port

Paste the following script into PowerShell. Adjust the port number in the first line to the port you want before you run it:

# Port 33445 is just an example port. You can use any free ports you want.

$newPort = 33445
$regPath = 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp'
Set-ItemProperty -Path $regPath -Name 'PortNumber' -Value $newPort
if (-not (Get-NetFirewallRule -DisplayName "RDP Port $newPort" -ErrorAction SilentlyContinue)) {
    New-NetFirewallRule `
      -DisplayName "RDP Port $newPort" `
      -Direction Inbound `
      -Protocol TCP `
      -LocalPort $newPort `
      -Action Allow
}
Restart-Service -Name TermService -Force
Write-Host "The RDP port has been changed."

What the script does in detail

1. It defines the new port number in the variable $newPort.
2. It sets the registry value PortNumber under HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp to that value.
3. It creates a matching rule in the Windows firewall that allows inbound TCP connections on the new port. If the rule already exists, it is not created a second time.
4. It restarts the Remote Desktop service (TermService) so that the change takes effect immediately.

Reconnecting after the change

Restarting the service disconnects every running RDP session right away. That is normal. For the new connection you no longer enter just the server address in the RDP client, but the combination of address and port:

<IP-Address>:<New-Port>

For our example that looks like this:

192.168.1.100:33445

Checking the current RDP port

You can read the port that is currently configured directly from the registry at any time:

Get-ItemProperty -Path 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp' -Name PortNumber

What you should take care of afterwards

• Adjust the upstream firewall: If there is an external firewall in front of your server, the new port has to be opened there as well. Otherwise you will not reach the server even though the Windows rule is correct.
• Check the old rule for port 3389: The existing "Remote Desktop" rule stays in place. Disable it if port 3389 should no longer be reachable.
• Restrict access: The most effective step is to limit RDP in the firewall to your own IP address. All automated attacks then run into nothing.
• Account already locked out? If your user account has already been locked out by the earlier attack attempts, our guide Fixing the RDP "Account locked out" error will help you further.