TCP port 3389 is the standard network gateway for the Remote Desktop Protocol (RDP), a system developed by Microsoft to allow users to access and control a Windows computer or server over a network connection. In the realm of network administration, this port is the primary interface for remote management, providing a full graphical user interface (GUI) to administrators and remote workers. However, because it provides direct access to the desktop environment and system controls, it is also one of the most frequently targeted ports by cybercriminals globally.

Technical Overview of TCP Port 3389

At its core, TCP port 3389 functions as a communication endpoint. When a computer enables Remote Desktop features, it begins "listening" on this specific port for incoming connection requests. As assigned by the Internet Assigned Numbers Authority (IANA), port 3389 is reserved specifically for Microsoft Terminal Server and Remote Desktop Services.

While the Remote Desktop Protocol is primarily associated with the Transmission Control Protocol (TCP), modern versions of RDP also utilize User Datagram Protocol (UDP) on the same port number. The distinction between these two is critical for performance:

  • TCP 3389: This is used for the reliable delivery of data. It handles the initial connection establishment, authentication, and the transmission of critical UI elements like menus and text. The connection-oriented nature of TCP ensures that no data packets are lost, which is essential for the stability of the remote session.
  • UDP 3389: In high-latency environments or when streaming video and audio through RDP, the protocol shifts to UDP. This allows for a smoother user experience by prioritizing speed over absolute packet reliability, effectively reducing the "lag" often associated with remote access.

From an architectural standpoint, when a client initiates a connection, it sends a synchronization (SYN) packet to the target machine's port 3389. If the port is open and the service is active, the server responds with a SYN-ACK, completing the three-way handshake that defines TCP communication.

How Remote Desktop Protocol Uses Port 3389

RDP is more than just a simple screen-sharing tool; it is a complex protocol that serializes graphical data and transmits it across the network. When port 3389 facilitates an RDP session, several layers of activity occur simultaneously.

The Connection Sequence

The process begins with the RDP client (such as the "Remote Desktop Connection" app on Windows) requesting a session. The server validates the request and negotiates the security layer. Ideally, this involves Transport Layer Security (TLS). Once the encrypted tunnel is established, the user is prompted for credentials.

Data Compression and Optimization

One of the reasons RDP became the industry standard for Windows remote access is its efficiency. Instead of sending raw video of the screen—which would consume immense bandwidth—RDP sends drawing commands. For instance, if you open a window, the protocol tells the client to "draw a rectangle at these coordinates with this color." This high-level communication is all funneled through port 3389, allowing for a responsive experience even on moderate internet speeds.

Peripheral Redirection

Port 3389 also handles the redirection of local resources to the remote server. This includes:

  • Clipboard Sharing: Copying text on your local machine and pasting it into the remote desktop.
  • Drive Mapping: Making your local C: drive appear as a network drive on the remote server.
  • Printer Redirection: Printing documents from the remote server to your local physical printer.

The Major Security Risks of an Exposed Port 3389

The visibility and power of port 3389 make it a double-edged sword. According to telemetry from various cybersecurity firms, millions of automated bots scan the internet daily specifically looking for open RDP ports. If port 3389 is exposed directly to the public internet without a firewall or VPN, it is not a matter of if it will be attacked, but when.

Brute-Force and Dictionary Attacks

This is the most common threat. Attackers use automated scripts to try thousands of common username and password combinations against port 3389. Since RDP is often used for administrative access, a successful brute-force attack gives the intruder full control over the machine. In our security audits, we have observed machines receiving over 10,000 failed login attempts per hour when left unprotected on a public IP.

The BlueKeep Vulnerability (CVE-2019-0708)

Historical vulnerabilities like BlueKeep demonstrated the catastrophic potential of an unpatched RDP service. BlueKeep was a "wormable" vulnerability, meaning an attacker could send a specially crafted request to port 3389 and execute code without any user interaction or valid credentials. This allowed malware to spread from one machine to another across the globe, similar to the WannaCry ransomware.

Ransomware Entry Point

RDP is currently the leading entry vector for ransomware attacks against small and medium-sized businesses. Once an attacker gains access through port 3389, they often disable antivirus software, delete backups, and encrypt the entire file system, demanding payment for the decryption key. The graphical nature of RDP makes it easy for even low-skilled attackers to navigate the victim's network once they are inside.

How to Check If TCP Port 3389 Is Open on Your Network

Determining the exposure of port 3389 is a fundamental step in network hardening. There are several ways to verify if a machine is listening on this port.

Using the Windows Command Prompt

On the local machine, you can check if the RDP service is active and listening by using the netstat command. Open a Command Prompt as an Administrator and run: netstat -ano | findstr :3389 If you see a line showing LISTENING with the local address :3389, the service is active. The PID (Process ID) at the end of the line will correspond to TermService (Terminal Services) in the Task Manager.

Network Scanning with Nmap

For security professionals, nmap is the tool of choice for remote port discovery. To scan a specific IP address for port 3389, use the following command: nmap -p 3389 -sV <target-ip> The -sV flag is particularly useful as it attempts to determine the version of the service running on the port, helping you identify if it is indeed a legitimate Microsoft RDP service or something else disguised as it. If the target machine blocks ICMP (pings), you may need to add the -Pn flag to force the scan.

Online Port Checkers

If you want to know if your router is exposing port 3389 to the public internet, you can use various web-based port scanning tools. By entering your public IP address and port 3389, these tools will tell you if the "door" is open to the outside world. In a secure environment, these external checks should always return a "Closed" or "Filtered" status.

Practical Steps to Secure TCP Port 3389

Securing RDP requires a multi-layered approach, often referred to as "Defense in Depth." Simply having a password is no longer sufficient.

Never Expose RDP Directly to the Internet

The single most important rule in RDP security is to keep port 3389 behind a firewall. If remote access is needed from the internet, users should first connect to a Virtual Private Network (VPN). Once the encrypted VPN tunnel is established, the user can then connect to the internal IP address on port 3389. This ensures that the RDP port is never visible to scanners on the public web.

Enable Network Level Authentication (NLA)

NLA is a critical security feature that requires the user to authenticate before an RDP session is even created. Without NLA, the server will load the full Windows login screen for anyone who connects to port 3389, which consumes system resources and increases the attack surface for exploits. With NLA enabled, the server validates the user's credentials using the Credential Security Support Provider (CredSSP) before allocating resources for the session.

Implement Multi-Factor Authentication (MFA)

MFA adds a second layer of verification. Even if an attacker steals or guesses a password, they cannot gain access without a one-time code from a mobile app or a hardware token. While RDP does not support MFA natively in all configurations, third-party solutions and the Microsoft Remote Desktop Gateway can be used to integrate this essential protection.

Use IP Whitelisting

If you must allow RDP access without a VPN (which is highly discouraged), you should at least restrict access to specific, trusted IP addresses. By configuring the Windows Firewall or your edge router to only allow traffic to port 3389 from your office's static IP, you block 99.9% of global automated attacks.

How to Change the Default RDP Port Number

Many administrators choose to move RDP from port 3389 to a "non-standard" port (e.g., 65000) to avoid automated scans. This is known as "Security by Obscurity." While it won't stop a determined hacker, it significantly reduces the noise in your logs from random bots.

Step-by-Step Registry Modification

To change the port, you must edit the Windows Registry:

  1. Press Win + R, type regedit, and hit Enter.
  2. Navigate to the following subkey: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
  3. Find the PortNumber DWORD.
  4. Double-click it, select Decimal, and enter your new port number (between 1025 and 65535).
  5. Click OK and restart your computer.

Important Note: After changing the port, you must update your Windows Firewall rules to allow traffic through the new port, otherwise, you will be locked out of your machine. When connecting via the RDP client, you will now need to specify the port in the address field (e.g., 192.168.1.50:65000).

Troubleshooting Common Port 3389 Connection Issues

Even with the correct settings, connections to port 3389 can fail. Understanding the common error codes can save hours of frustration.

Error 10060 (Connection Timed Out)

This usually indicates that a firewall is silently dropping the packets. Check the hardware firewall on your router and the software firewall on the target Windows machine. Ensure that the "Remote Desktop" app is allowed through the firewall.

Error 10061 (Connection Refused)

This means the packet reached the target machine, but the machine actively said "No." This typically happens because the Remote Desktop Service (TermService) is not running, or the machine is not configured to allow remote connections in the System Settings.

CredSSP Encryption Oracle Remediation

If you encounter an error mentioning "CredSSP," it is usually due to a mismatch in security updates between the client and the server. This occurred frequently after Microsoft patched a major RDP vulnerability; both the connecting and receiving machines must have the latest security patches for NLA to work correctly.

Summary

TCP port 3389 is the backbone of remote Windows administration, enabling the high-performance, feature-rich Remote Desktop Protocol. While it offers unparalleled convenience for IT teams and remote workers, its default nature makes it a prime target for cyberattacks ranging from brute-force login attempts to sophisticated ransomware deployments.

By understanding the technical mechanics of port 3389 and implementing a layered security strategy—including VPNs, Network Level Authentication, and robust firewall rules—organizations can leverage the power of RDP without exposing their critical infrastructure to unnecessary risk. Whether you choose to keep the default port or move to a non-standard one, the priority must always be strict access control and continuous monitoring.

FAQ

What is the default port for Remote Desktop?

The default port for Microsoft's Remote Desktop Protocol (RDP) is TCP 3389. It may also use UDP 3389 for enhanced performance in modern Windows versions.

Is it safe to leave port 3389 open?

No, leaving port 3389 open to the public internet is considered a high-security risk. It invites automated brute-force attacks and exposes the system to potential RDP-specific vulnerabilities.

Can I run RDP on a different port?

Yes, you can change the RDP port by modifying the PortNumber value in the Windows Registry under the RDP-Tcp subkey. However, you must also update firewall rules accordingly.

Does RDP use TCP or UDP?

RDP primarily uses TCP 3389 for reliable connection and control. However, it can also utilize UDP 3389 to provide better performance for audio and video data in high-latency network conditions.

How do I close port 3389?

To close the port, you can disable Remote Desktop in the Windows System Settings (Settings > System > Remote Desktop) or block port 3389 in the Windows Defender Firewall inbound rules.