Remote Desktop Protocol - CHANGE 3389 Default Port

[@villumschroeder1255]

What an eye opener. Awesome job. Thank you very much. I detect an East Coast Accent...

[@servermatter4465]

Thank you! It was an eye opener for me as well. Yes, Massachusetts ;-)

[@troolal2402]

In case if any of you were wondering the registry thing is Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

[@servermatter4465]

I apologize if I missed that in the video. That is the correct information. Thank you.

[@ryan.quintin]

But there are websites that scans all posible open ports in a specific public ip. Hackers can automate the checking each open ports for matching which server services are assigned to it. For me, a good antimalware software installed on your server can protect every open port and other techniques used by hackers.

[@servermatter4465]

Of course you are correct. However you will notice with this video that the number of attacks drops like a rock when the port is changed. There are many security measures that should be put in place. This is one of them. Everyone knows 3389 and the everyday hackers use it. So let's at least put that on the short list of things to be done.

[@wag-on]

If you know the IPs of the inbound machine(s) you can whitelist on the existing RDP rule under the Scope tab.

[@jaylepore5420]

That's a good addition to the knowledgebase here. Especially where the remote user is typically stationary.

[@abishekanuroop3577]

Hi, Thanks for the video ! I however have one thing to ask , if we change the port number on the destination PC (using registry updates + firewall updates) , should we also change it at the source PC ? assuming that port forwarding is taken care of by the Destination PC's router.

[@servermatter4465]

Yes. The machine that is connecting to the target system will need to have its IP address entered as 192.xx.xxx.xxx:XXXX so whatever that new port number is must come after that last colon :

[@abishekanuroop3577]

Appreciate the quick response.Thanks for clarifying !

[@morsheddld]

After changing office pc 3389 port how would i connect to office pc from home? Remote desktop by default would try connect via 3389, right? There r many remote desktop connectors software available like Anydesk, teamviewer, radmin. How would i connect using these kind of apps?

[@servermatter4465]

The real purpose of this video is for people who are already using 3389. It's not a tutorial on setting things up. That said, whatever port you set in Windows, you would have to open the same port in the Port Forwarding area of your office router and point it to the machine you are trying to control via RDP. Beyond that you'll access your machine by using your office's public IP address and the port ie; 45.67.89.90:XXXX where XXXX is your new port number. If all that sounds like brain damage :-) look into Rust Desk. It's free and highly recommended by many -- rustdesk.com Teamviewer is of course another well known remote desktop but it comes with some commercial use restrictions www.teamviewer.com

[@CSIG1001]

After changing your port number , you can also change the windows password threshold to lock out the user after 2 tries for 30 min or more. If your machine is getting hacked brute force hacking you will know since the user is locked out.

[@villumschroeder1255]

Aside from checking to be sure the new port number isn't being used, is there any other consideration in choosing the new port number or is it random? Thanks!

[@servermatter4465]

Totally random. Most will just keep hammering 3389. However there are much fewer who will scan your system for all open ports and then try each of them. That's a lot more work for them but I have experienced those attempts even when choosing port numbers greater than 40000+ However there will be FAR fewer hackers that do this. A complex password is still a very important requirement as it's your only hope. Otherwise, use Malwarebytes to detect brute force attacks.

[@villumschroeder1255]

Excellent. I have the paid Malwarebytes product but was thinking of changing to Bit Defender as it seems a lot more robust/comprehensive in it's protection. What are your thoughts? Thanks again!!

[@servermatter4465]

@@villumschroeder1255 I cannot speak for Bit Defender. I can only say Malwarebytes was perfect for this intended solution where others had failed. I did not try Bit Defender.

[@villumschroeder1255]

Very well thanks🙏

[@phoenixkissme]

That's is why remote desktop is not secure.

[@CSIG1001]

its secure if you make it secure nothing is 100% secure by default