Change Remote Desktop Port Windows 11: Registry Edit for Secure Access

Changing Windows 11’s default Remote Desktop port is one of those small tweaks that makes a big security difference. I’ve done this on dozens of machines from my days at Microsoft to my current setup in Denver.

The registry edit itself takes under 5 minutes, but you’ll need admin rights and careful attention to the port number. One wrong digit and you’re locked out until you fix it manually. Between you and me, I learned that the hard way.

After the change, you’ll need to update your firewall rules and router forwarding to match. The whole process is foolproof if you follow the exact steps—no special tools required, just regedit and a steady hand.

Works on any Windows 11 Pro or Enterprise machine. The peace of mind from avoiding the default port is worth the minimal effort.

What Youll Need

Step-by-Step Instructions for Changing the Remote Desktop Port

Here’s the procedure I use to modify the default port for secure remote access.

Press Win + R, type regedit, then press Ctrl + Shift + Enter to launch Registry Editor as administrator. Accept the UAC prompt when it appears. This elevated access is required to modify system-level registry keys.

Navigate to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp. I always double-check this path carefully—it’s easy to miss a folder in the hierarchy, and editing the wrong key won’t change the port.

In the right pane, locate the PortNumber entry. Right-click it and select Modify. By default, this shows 3389 in hexadecimal format (0xd3d). I prefer working in decimal for port numbers, so I change the base to Decimal in the dialog.

Enter your new port number (between 1024 and 65535). For example, 3390 is a common alternative. Click OK and verify the change appears in the value data column. Don’t close Registry Editor yet—you’ll need it for the next step.

Open Windows Defender Firewall with Advanced Security from the Start menu. In the left pane, select Inbound Rules. Scroll to find the rule named Remote Desktop (TCP-In)—there may be multiple versions for different profiles.

Right-click each Remote Desktop (TCP-In) rule and select Properties. Under the Protocols and Ports tab, change the Local port to match your new number. Apply the changes to all profiles (Domain, Private, Public) to ensure consistent access.

Open an elevated Command Prompt (Win + X, then select Terminal (Admin)). Run net stop termservice /y to stop the service, then net start termservice to restart it. Wait for confirmation that the service started successfully.

Alternatively, restart the computer to ensure all changes take effect. I always test the connection immediately after making these changes to confirm the new port is working as expected.

From another computer, open Remote Desktop Connection and enter the target PC’s IP address followed by a colon and your new port (e.g., 192.168.1.100:3390). If the connection fails, double-check the firewall rules and service status.

For added security, I recommend changing the router’s port forwarding rules to match the new port if you’re accessing the PC from outside your local network. This completes the port change process.

Tips and Common Mistakes

These practical pointers will help you avoid common pitfalls when modifying system settings.

The Registry Path Precision: In Step 1, that exact path HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp is non-negotiable. I learned this the hard way after editing the wrong key twice—double-check each folder in the hierarchy before making changes.

Decimal vs. Hexadecimal: For Step 2, always switch to Decimal base when entering your new port number. The default hexadecimal display (0xd3d for 3389) can be confusing, and entering the wrong format will prevent the change from taking effect. Trust me on this.

Service Restart Verification: During Step 4, don’t just run the commands—watch for the confirmation message that the service started successfully. If you see an error, wait 30 seconds and try again. A failed restart means your port change won’t work, no matter how perfectly you edited the registry.

Connection Testing: In Step 5, test from another device immediately after making changes. If the connection fails, don’t panic. Nine times out of ten, it’s a firewall rule that wasn’t updated for all profiles (Domain, Private, and Public) as mentioned in Step 3.

Frequently Asked Questions

Changing your Remote Desktop port in Windows 11 is a simple yet effective way to enhance security. By following the registry edit steps, you’ve made your system less vulnerable to automated attacks. 🔒 Next, test your new connection to ensure everything works smoothly, and consider setting up a firewall rule for added protection.