- Dacpac and Bacpac in SQL Server - Tue, May 30 2023
- Proxmox Backup Server: Install and configure - Fri, May 19 2023
- Using Docker with NAS and NFS - Mon, May 15 2023
Remember the infamous BlueKeep vulnerability? It exploited port 3389 by sending a specially crafted message that allowed the attackers to execute any code remotely on a compromised system. Considering the security risk, it is often recommended to disable RDP when it is not needed; however, there are still certain systems where you just can't disable it, such as servers.
The alternative solution is to change the RDP port number from the default to something else. This certainly won't make your Windows system bulletproof, but it surely does help stop a few script kiddies. I mean, that's the whole point of security through obscurity.
For this guide, I will change the RDP port on a system named TERMINAL that is running Windows 10. Since we are using PowerShell, we can leverage PowerShell remoting to run all the commands from our own system. Just launch an elevated PowerShell console, and use the following command to open an interactive PS remoting session to the remote computer where you want to change the RDP port.
Enter-PsSession -ComputerName TERMINAL -Credential domain\admin
If your currently logged-in user is a member of the Domain Admins AD group, you can skip the -Credential parameter.
You can also use the Invoke-Command cmdlet to run each command if you don't wish to open a persistent interactive session to the remote computer.
Determining the current Remote Desktop port
Now that we are connected to a remote computer (TERMINAL, in our example), you can use the following command to determine what port number RDP is currently using:
(Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\" -Name PortNumber).PortNumber
This command returns the current port number used by the RDP service on your target computer. You can see that the information is stored in the Windows registry, and we just queried the particular registry key for the port number using the Get-ItemProperty cmdlet. Modern versions of Windows (starting with Server 2012 and Windows 8) tend to use both the TCP and UDP protocols for RDP, which essentially means that, by default, the remote desktop server service (TermService) listens on both TCP 3389 and UDP 3389 on a typical Windows system. You can confirm this by running the Get-NetTCPConnection and Get-NetUDPEndpoint commands, as shown in the following screenshot:
Changing the RDP port
Now that you are sure that the remote desktop service on your target computer is currently using a default port, use the following command to change the RDP port number:
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\" -Name PortNumber -Value 50102
This command uses the Set-ItemProperty cmdlet to change the port number to an ephemeral port (50102, in our example). When you change the RDP port number using this command, both the TCP and UDP endpoints will be changed to the same port number.
You can use any port number, but it is recommended to use one between 1024 and 65535. Some people even like using a port number from the IANA suggested range (49152–65535), since it is not likely to conflict with other well-known or custom services.
Adding firewall rules for custom RDP ports
Now that the RDP port number has changed, you need to adjust the Windows Defender firewall to allow your new custom RDP port. Use the following PowerShell commands to add the rules:
New-NetFirewallRule -DisplayName "Custom RDP Port (TCP-In)" -Direction Inbound -LocalPort 50102 -Protocol TCP -Action Allow New-NetFirewallRule -DisplayName "Custom RDP Port (UDP-In)" -Direction Inbound -LocalPort 50102 -Protocol UDP -Action Allow
These two commands add rules to allow inbound traffic on the custom RDP port number. Make sure you modify the port number to match your own.
If you intend to access the remote desktop from a list of known IP addresses, you could slightly modify the above commands to permit the known IPs only like this:
$myIPs = @("220.127.116.11", "192.168.10.15-192.168.10.17", "192.168.100.0/24") New-NetFirewallRule -DisplayName "Custom RDP Port (TCP-In)" -Direction Inbound -LocalPort 50102 -Protocol TCP -RemoteAddress $myIPs -Action Allow New-NetFirewallRule -DisplayName "Custom RDP Port (UDP-In)" -Direction Inbound -LocalPort 50102 -Protocol UDP -RemoteAddress $myIPs -Action Allow
Remember that the remote computer will continue to use the old (default) port number until the Remote Desktop service (TermService) is restarted on the target computer. To restart the service on the target computer, use the following command:
Restart-Service TermService -Force
Once the remote desktop service is restarted, the target computer will start listening on a new custom RDP port number.
Verifying the new RDP port
At this point, your remote computer is all set to use a custom port for Remote Desktop. If you run the following PowerShell command on a remote computer, it will give you the new endpoints:
Get-NetTCPConnection -LocalPort 50102; Get-NetUDPEndpoint -LocalPort 50102
Alternatively, you could use the Test-NetConnection cmdlet on your own computer, as shown in the following command:
Test-NetConnection -ComputerName TERMINAL -Port 50102 -InformationLevel Quiet
True in output indicates that your local computer was able to successfully connect to a remote computer on the specified port number (50102, in our example), which proves that your new custom RDP port is now active. If you repeat this command with the default RDP port number, the connection will fail and will return false, as shown in the screenshot.
Using the custom Remote Desktop port
When the Remote Desktop service runs on the default port, you do not need to specify it when connecting to the target computer using the Remote Desktop Connection application. However, once you customize the port, you need to specify the port number in ComputerName:PortNumber or IPAddress:PortNumber format, as shown in the screenshot:
Subscribe to 4sysops newsletter!
You just learned how to change the remote desktop port number using PowerShell. As discussed earlier, a custom RDP port doesn't promise to make a Windows system fully secure, but it adds a layer of obscurity to offer protection to a certain degree. It is always a good idea to disable Remote Desktop on public-facing Windows hosts. If you really have to keep Remote Desktop enabled, it is highly recommended that you use VPN.
Join the 4sysops PowerShell group!
Your question was not answered? Ask in the PowerShell forum!
After doing this attempt to run nmap against those ports. I believe the command is this.
#nmap -p0- -v -A -T4
It should show that the obfuscation of changing the port number is easily detected and VPN is absolutely necessary.
You’re right. VPN is the way to go for RDP access over internet but port obfuscation also helps a bit to keep dumb-bots in check who keep knocking on the default ports.
Additionally, if you access remote desktop from known IP addresses only, it is a good idea to modify the firewall rules to permit your custom RDP port for known IP addresses only to make it more secure.