Port 3389RDP (Remote Desktop)

What port 3389 is used for

RDP transmits a Windows desktop to a remote client and returns keyboard, mouse, clipboard, audio and optionally drive and printer redirection. It is built into Windows Pro, Enterprise and Server editions (Home editions include only the client). System administrators use it to manage servers; support teams use it to help users; organisations use Remote Desktop Services to host shared desktops and applications.

The IANA name ms-wbt-server stands for Microsoft Windows Based Terminal, the original 1990s product name.

TCP and UDP

How RDP is protected

Modern RDP negotiates TLS before authentication. With Network Level Authentication (NLA) enabled, the client must authenticate before a desktop session is even created, which blocks unauthenticated attackers from reaching the logon screen and reduces the impact of several historical vulnerabilities. NLA is on by default in current Windows versions and should stay on.

Security considerations

An RDP listener reachable from the internet is a primary entry point for ransomware operators. Automated scanners find it, credential-stuffing tools attack it, and a single valid login yields a full interactive desktop. Treat inbound 3389 as a privileged path:

• Do not expose 3389 to the internet. Reach it through a VPN, a Remote Desktop Gateway (which uses HTTPS on 443), or a zero-trust access broker.
• Require NLA and keep it enabled.
• Use strong, unique passwords and MFA for every account permitted to log on remotely.
• Limit who can connect with the Remote Desktop Users group, and restrict source addresses in the firewall rule.
• Enable account lockout to slow password guessing, and monitor event ID 4625 (failed logon) for spikes.
• Patch promptly. Several critical RDP vulnerabilities have been wormable.

Moving RDP to another port hides it from the laziest scanners only.

How to check port 3389

Is something listening locally? On Windows, open Command Prompt and run:

netstat -ano | findstr :3389

A line in the LISTENING state means a local program has bound port 3389; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :3389 or lsof -i :3389.

Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:

Test-NetConnection example.com -Port 3389

TcpTestSucceeded : True means the remote system accepted a TCP connection on port 3389. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.

See the netstat and Test-NetConnection records for the full option sets.

Confirm the Remote Desktop service is running before troubleshooting connectivity:

Get-Service TermService

Firewall considerations

Windows enables the "Remote Desktop (TCP-In)" and "(UDP-In)" rules automatically when Remote Desktop is turned on, scoped to the profiles you choose. Restrict the rule to the Private or Domain profile and, where possible, edit its Scope to the management subnet only. On the internet edge, do not forward 3389.

On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 3389 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.