Change Windows Server RDP Port

Changing the port is necessary because leaving the default makes it easier for potential attackers to find opportunities to connect to the server. First you need to open the port.

You can open the port from the command line. Important! In the command below, instead of NEW_PORT, enter the number of the port you want to replace the default RDP port with.

netsh advfirewall firewall add rule name="Custom RDP Port" dir=in action=allow protocol=TCP localport=NEW_PORT

or in another way:

Then go to "Control Panel" - "Windows Firewall" - "Advanced Options"

In the window that appears, select "New rule"

Next, we indicate the port that you specified in paragraph 3, the rule that will be applied to connections to this port, network types (only local, or external too) and the name for the rule.

Change port

Open the registry editor, for this press Win + R and type regedit

Open the branch
HKEY_LOCAL_MACHINE \ System \ CurrentControlSet \ Control \ TerminalServer \ WinStations \ RDP-Tcp

Select the PortNumber parameter, select Decimal and change the value for it to the number of the port that you plan to use, for example, 55555 (by default 3389)

Restart the Remote Desktop service

Changing the port number in the registry does not take effect right away. Restart the Remote Desktop service so the new port becomes active. Open PowerShell as administrator and run:

Restart-Service TermService -Force

Connect using the new port

From now on the server does not listen on the default port, so you have to specify the new port when you connect. Open the Remote Desktop client (mstsc), and enter the server address followed by a colon and the new port, for example 203.0.113.10:55555.

Close the default port 3389

After you confirm that the connection through the new port works, close the default port 3389. If you leave it open, the server is still reachable on the well-known RDP port, and changing the port gives almost no benefit.

Open Windows Defender Firewall with Advanced Security again, go to Inbound Rules, find the built-in rule "Remote Desktop - User Mode (TCP-In)" and disable it. Your custom rule for the new port stays in place, so access through the new port keeps working.

netsh advfirewall firewall set rule group="remote desktop" new 
enable=No