Remote Desktop Listens on Which TCP Port Number: Default and Custom Port Settings Explained

That TCP port 3389 is Microsoft's standard for Windows Remote Desktop Protocol (RDP), but Linux systems often use different ports depending on the remote access tool—like VNC's 5900+ or xrdp's configurable ports. 🔥 I've seen admins change this port to dodge automated scans, though it's not foolproof.

The real security comes from combining port changes with strong authentication and firewall rules, not just hiding behind an obscure number.

For example, Windows Server admins might shift to port 3390 or higher, but they still need to update their firewall and client connection strings. Linux users often tweak /etc/xrdp/xrdp.ini or use SSH tunneling instead.

The key takeaway? Changing ports adds a layer of security, but it's just one piece of the puzzle—never your only defense.

Default RDP port settings across operating systems

Microsoft's Remote Desktop Protocol (RDP) has used TCP port 3389 as its default since Windows NT 4.0 Terminal Server Edition in 1995. This port became the industry standard because it was explicitly assigned by IANA (Internet Assigned Numbers Authority) for Microsoft Terminal Services.

The number 3389 wasn't chosen randomly—it's a nod to the year Microsoft released Windows NT 3.51, which introduced early remote access capabilities. 🔥

On Windows systems, this port remains consistent across all versions from Windows XP to Windows 11, though Windows Server editions often see variations when administrators reconfigure for security.

The protocol's design requires both TCP and UDP traffic, with TCP handling the actual connection and UDP managing keep-alive messages to maintain the session. This dual-port requirement is why you'll see both TCP and UDP rules when configuring firewalls for RDP.

Linux systems don't natively support RDP—they typically use alternatives like VNC (Virtual Network Computing), which defaults to TCP port 5900 for the first display session, with each additional session incrementing by one (5901, 5902, etc.).

The xrdp project (X Remote Desktop Protocol) brings RDP compatibility to Linux but defaults to port 3389 unless modified in /etc/xrdp/xrdp.ini. This creates an interesting parallel: while Windows systems are hardcoded to 3389, Linux administrators have more flexibility to choose different ports right from installation.

macOS presents a different scenario entirely. While it doesn't have native RDP support, Apple's Remote Management (ARDM) uses TCP port 5555 by default, and third-party solutions like Microsoft Remote Desktop for Mac connect to Windows systems using the standard 3389 port.

The operating system's Unix foundation means macOS remote access tools often follow similar port conventions to Linux solutions, creating a 5900+ range for VNC-based connections when used.

What's particularly interesting is how these defaults interact with network security. Port 3389 is one of the most scanned ports on the internet—automated bots constantly probe for open RDP connections, making it a prime target for brute force attacks.

This is why many administrators change the default port, though it's important to note that simply changing the port number doesn't make your system secure—it just makes it slightly harder for automated tools to find.

The real security comes from combining this with strong passwords, multi-factor authentication, and proper firewall configuration.

Here's a quick comparison of default ports across systems:

• Windows: TCP 3389 (RDP), UDP 3389 (keep-alive)
• Linux (VNC): TCP 5900+ (display-specific)
• Linux (xrdp): TCP 3389 (configurable)
• macOS (ARDM): TCP 5555 (default)

The consistency across Windows systems creates both convenience and vulnerability. While it's easy for administrators to remember and configure, it also makes Windows systems more predictable targets.

This is why you'll often see Windows Server administrators change their RDP port during initial setup—it's one of the first security measures implemented in many enterprise environments. 💫

How to change Remote Desktop TCP port for security

Changing your Remote Desktop port is one of the simplest security upgrades you can make. On Windows, open the Registry Editor by pressing Win + R, typing regedit, and navigating to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.

Look for the PortNumber value and change it to your desired port (like 3390 or higher). Remember to update your firewall rules afterward to allow traffic on this new port. 🔥

For Windows Server environments, Group Policy offers a more centralized approach. Open gpedit.msc, navigate to Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Connections, and modify the Specify the port number setting.

This method is ideal for managing multiple servers consistently. Always test your new port configuration with a remote connection before applying it to production systems.

Linux users have different options depending on their setup. If using xrdp, edit the configuration file at /etc/xrdp/xrdp.ini and change the port= setting. For VNC connections, modify the port in your VNC server configuration (like ~/.vnc/config or /etc/tightvncserver.conf).

After making changes, restart the service with sudo systemctl restart xrdp or sudo systemctl restart vncserver. SSH tunneling is another secure alternative that routes RDP traffic through SSH port 22.

Security best practices extend beyond just changing the port. Always combine this with strong passwords, network-level firewalls, and consider implementing multi-factor authentication. Port forwarding on routers should be limited to trusted IP addresses only.

Remember that changing ports won't stop determined attackers—it just adds an extra layer of difficulty for automated scans. The most secure setups use a combination of non-standard ports, network segmentation, and regular security audits. ✨

One common mistake is forgetting to update client connection strings. When connecting from another machine, you'll need to specify the new port using :newport after the IP address (e.g., 192.168.1.100:3390). Also document your port changes thoroughly—future administrators will thank you when troubleshooting connection issues.

For extra security, consider using a VPN to encapsulate all remote connections rather than exposing ports directly to the internet.