Oudel Inc

How to Change the RDP Port on a Windows Server

Image

Remote Desktop Protocol (RDP) is a crucial tool for managing Windows servers remotely. By default, RDP uses port 3389, a well-known setting that can make servers vulnerable to brute force or automated attacks. Changing the RDP port is a simple but effective way to enhance security and reduce the risk of unauthorized access.

This article provides a comprehensive guide on how to change the RDP port on a Windows server, including step-by-step instructions, troubleshooting tips, and security considerations.

Why Change the RDP Port?

Changing the default RDP port offers several benefits:

  1. Increased Security: The default port is a frequent target of attackers. Using a custom port makes it harder for automated tools to locate your server.
  2. Compliance: Many security standards require non-default configurations to reduce vulnerabilities.
  3. Port Conflicts: Resolving conflicts with other applications that might use the same port.

However, changing the RDP port is not a standalone security measure. Combine it with firewalls, strong authentication, and regular monitoring for optimal protection.

Prerequisites

Before making changes, ensure the following:

  1. Administrator Access: You need administrative rights on the Windows server.
  2. Backup: Create a backup or system restore point in case issues arise during the process.
  3. Firewall Configuration: Prepare to update firewall rules to allow the new port.
  4. Alternative Access: Ensure you have an alternative way to access the server, such as a cloud provider console.

Step-by-Step Guide to Changing the RDP Port

Step 1: Access the Registry Editor

The RDP port setting is stored in the Windows Registry. To modify it:

  1. Press Win + R, type regedit, and press Enter.
  2. If prompted by User Account Control, click Yes to open the Registry Editor.

Step 2: Locate the RDP Port Configuration

  1. Navigate to the following path in the Registry Editor:
    arduinoCopy codeHKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
  2. In the right-hand pane, look for the PortNumber key.

Step 3: Modify the Port Number

  1. Double-click the PortNumber key to open its properties.
  2. Select the Decimal base to view the current port number in decimal format (default: 3389).
  3. Enter your desired port number. Choose a value between 1025 and 65535 that is not already in use. For example, you might select 5001.
  4. Click OK to save the changes.

Step 4: Update Firewall Rules

After changing the RDP port, update your firewall to allow traffic on the new port:

  1. Windows Firewall: Open Windows Defender Firewall from the Control Panel.
    Click Advanced Settings on the left sidebar.
    Select Inbound Rules, and locate the existing rule for RDP (TCP-In).
    Edit the rule to change the port to your new value. Alternatively, create a new rule for the new port.
  2. Cloud Provider Firewalls:If your server is hosted on AWS, Azure, or another cloud provider, update the security group or network rules to allow the new port.

Step 5: Restart the Remote Desktop Service

For the changes to take effect, restart the Remote Desktop Services:

  1. Open the Services application by typing services. msc in the Run dialog (Win + R).
  2. Locate Remote Desktop Services in the list.
  3. Right-click and select Restart.

Step 6: Test the New Configuration

  1. Open your Remote Desktop client.
  2. Specify the new port in the connection address:
    phpCopy code<Server IP or Hostname>:<New Port>
    Example: 192.168.1.100:5001
  3. Verify that the connection is successful.

Troubleshooting

If you encounter issues, consider the following:

1. Cannot Connect to the Server

  • Firewall Rules: Double-check that the firewall allows traffic on the new port.
  • Incorrect Port: Ensure you’re entering the correct port in your RDP client.

2. Port Conflict

  • Use the netstat -ano command in Command Prompt to check if another application is using the new port.
  • Select a different port if there is a conflict.

3. Locked Out

  • Use your cloud provider’s console (e.g., AWS Systems Manager or Azure Serial Console) to revert the port change in the registry or firewall.

Security Best Practices

While changing the RDP port adds a layer of obscurity, it should be part of a broader security strategy. Consider these best practices:

  1. Restrict Access: Limit RDP access to trusted IP addresses using firewall rules.
  2. Enable Network Level Authentication (NLA): Require authentication before establishing an RDP session.
  3. Use Strong Passwords: Ensure that all accounts with RDP access have complex, unique passwords.
  4. Enable Multi-Factor Authentication (MFA): Add an additional layer of security to the login process.
  5. Deploy a VPN: Require users to connect to the server via a Virtual Private Network (VPN) before accessing RDP.
  6. Regular Updates: Keep your server and applications updated to address vulnerabilities.
  7. Monitor Access: Regularly review logs for unauthorized login attempts or unusual activity.

Reverting the RDP Port

If you need to revert the RDP port to its default value:

  1. Open the Registry Editor and navigate to the RDP-Tcp key as described earlier.
  2. Change the PortNumber value back to 3389.
  3. Update your firewall rules to allow traffic on port 3389.
  4. Restart the Remote Desktop Services.

Conclusion

Changing the RDP port on a Windows server is a straightforward process that enhances security by reducing the risk of unauthorized access. While it won’t replace other security measures, it’s an essential step for server hardening.

By following the steps in this guide and implementing security best practices, you can protect your Windows server against common threats while maintaining convenient remote access. Always test your configuration changes in a controlled environment to ensure uninterrupted connectivity.