Changing the remote desktop port (3389) without locking yourself out

Everybody knows port 3389, and bots try passwords on it around the clock. Moving it to another port does not replace a good password, but it cuts that noise enormously. Order matters: open the new port first, then change remote desktop.

1. Pick a port

A high one nothing else uses, between 10000 and 65000. In this example, 50000. Avoid your game ports (30120, 25565, 28015, 7777...).

2. Open it in the firewall

In PowerShell as administrator:

New-NetFirewallRule -DisplayName "Remote desktop TCP 50000" -Direction Inbound -Protocol TCP -LocalPort 50000 -Action Allow -Profile Any
New-NetFirewallRule -DisplayName "Remote desktop UDP 50000" -Direction Inbound -Protocol UDP -LocalPort 50000 -Action Allow -Profile Any

3. Change the remote desktop port

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 50000
Restart-Service TermService -Force

Restarting the service drops your connection: that is expected.

4. Connect on the new port

In Remote Desktop Connection, type the IP followed by a colon and the port: 203.0.113.10:50000.

5. Close 3389 (optional)

Once you have checked you can get in on the new one, disable the old rules:

Disable-NetFirewallRule -DisplayGroup "Remote Desktop"

If you lock yourself out

Use the panel's VNC console, which does not depend on the network, and undo the change:

Set-ItemProperty -Path "HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 3389
Enable-NetFirewallRule -DisplayGroup "Remote Desktop"
Restart-Service TermService -Force

Spain servers: if you have hand-made remote desktop filters in the Security tab, add the new port there too.

To round off the protection, see how to protect remote desktop from attacks.