RDP Port Configuration: Security Best Practices 2025 Guide

Remote Desktop Protocol (RDP) is a powerful tool — but it's also one of the most common attack vectors for hackers. In 2025, brute-force attacks on RDP ports account for millions of compromised servers per day. This guide shows you how to configure and secure your RDP environment properly.

What Is the Default RDP Port?

By default, Windows RDP uses TCP/UDP Port 3389. This is universally known, which makes it the primary target for automated scanners and brute-force bots. Leaving port 3389 open without additional security is a serious risk.

Why Port 3389 Is a Security Risk

• It is targeted by automated brute-force tools 24/7
• Malware bots constantly scan the internet for open port 3389
• Known vulnerabilities (BlueKeep, DejaBlue) specifically target this port
• Default usernames like "Administrator" combined with weak passwords are trivially guessed

How to Change the Default RDP Port

1. Press Win + R, type regedit, and press Enter.
2. Navigate to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
3. Find PortNumber, right-click it, and select Modify.
4. Switch to Decimal and enter a new port number (e.g., 3390, 4500, or any unused port above 1024).
5. Click OK, then restart your computer.
6. Update your Windows Firewall to allow inbound traffic on the new port.

Verify the change with PowerShell:

Security Best Practices for RDP in 2025

• Change the default port from 3389 to a custom port
• Enable Network Level Authentication (NLA) — requires credentials before session opens
• Use Multi-Factor Authentication (MFA) with tools like Duo or Microsoft Authenticator
• Whitelist IPs in the firewall — only allow your known IP addresses
• Use strong passwords — minimum 16 characters, alphanumeric + symbols
• Enable account lockout policies — lock after 5 failed login attempts
• Monitor RDP logs — review Event Viewer for suspicious login attempts regularly
• Use a VPN before connecting over public internet
• Keep Windows updated — patches close known RDP vulnerabilities

Firewall Configuration

Restrict RDP access by IP using Windows Firewall:

1. Open Windows Defender Firewall with Advanced Security.
2. Go to Inbound Rules → New Rule.
3. Select Port, choose TCP, enter your custom RDP port.
4. Select Allow the connection.
5. Under Scope, add only your trusted IP addresses.