Change the Remote Desktop (RDP) Port on Windows Server

Your account keeps locking itself? It's most likely bots trying to connect on the default port. Let's change it to fix that.

What's the problem?

The default RDP port is 3389. Every bot on the Internet knows it and scans it non-stop. They try random passwords, and eventually Windows locks the account.

  🤖 Bot                           🖥️ Your server
  │                                 │
  │── try admin / 123456 ─────────> │ ❌ Nope
  │── try admin / password ───────> │ ❌ Nope
  │── try admin / azerty ─────────> │ ❌ Nope
  │── ... x500 ───────────────────> │ ❌ Nope
  │                                 │
  │                                 │ 🔒 Windows locks the account
  │                                 │
  👤 You                            │
  │── normal login ───────────────> │ ⛔ "Account is locked"

Change the port, bots find nothing:

  🤖 Bot ── scan 3389 ──> ❌ Closed ──> moves on

  👤 You ── connect on 3390 ──> ✅ Works fine

Step 1 — Change the port in the registry

Open PowerShell as admin:

Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 3390

Replace 3390 with whatever port you want (between 1024 and 65535).

Or via regedit:

1. Win + R → regedit
2. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
3. Double-click PortNumber → select Decimal → type 3390 → OK

Step 2 — Open the new port in the firewall

New-NetFirewallRule -DisplayName "RDP Custom Port" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow

Step 3 — Restart the RDP service

Restart-Service TermService -Force

Step 4 — Connect using the new port

In your Remote Desktop client, type:

YOUR_IP:3390

For example: 82.26.157.98:3390

⚠️ Don't close your current session until you've tested the new port works.

Step 5 — Block the old port (optional)

Once everything works:

New-NetFirewallRule -DisplayName "Block RDP 3389" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block

Check it works

netstat -an | findstr "3390"

You should see:

TCP    0.0.0.0:3390    0.0.0.0:0    LISTENING

Going further

If you want extra security, you can restrict access to your IP only:

# Allow only your IP
New-NetFirewallRule -DisplayName "RDP My IP" -Direction Inbound -Protocol TCP -LocalPort 3390 -RemoteAddress "YOUR_IP_HERE" -Action Allow

# Block everything else
New-NetFirewallRule -DisplayName "RDP Block Others" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Block

Only do this if your IP is static, otherwise you'll lock yourself out.

Summary