How To Change Remote Desktop (RDP) Port With PowerShell #RDP #PowerShell

2 Min. Read

Introduction

As you already know that Remote Desktop Connection (RDC) for Windows listens on Port 3389 by default.

Microsoft claimed that the Remote Desktop Connection Client for the Mac supports only port 3389, however, this information is not correct. You can change the RDP port for any Windows machine as described in this article and then connect from your MAC machine to Windows (e.g. 10.10.10.10:3395).

This port is disabled in Windows Firewall by default. If you need to allow access to any server or client internally, you need to enable Remote Desktop on the desired machine, if you want to enable external access, then you need to enable Remote access on your edge Firewall and on the desired machine as well.

Changing the listening port will help to “hide” Remote Desktop from hackers who are constantly scanning the network for computers listening on the default Remote Desktop port (TCP 3389). This offers effective protection against the latest RDP worms and adds additional security to your environment.

Another scenario where changing the listening port is useful if you want to allow external access to internal resources and you have only one Public IP address, in this case, what you need to do, is to change the listening RDP default port number (TCP 3389) to different port number on each server.

Changing the listening port for Remote Desktop the manual way is described by Microsoft here.

In this post, I will show you how to change the port that Remote Desktop listens on a large number of servers with PowerShell.

Change the listening port for RDP with PowerShell

Assume you have installed the Active Directory module for the Windows PowerShell module on your management machine.

Open Windows PowerShell with Administrator privilege and run the following script:

$DCs = Get-ADComputer -Filter * -SearchBase "CN=Computers,DC=VIRT,DC=LAB"
Foreach ($DC in $DCs) {
Invoke-Command -ComputerName $DC.Name -ScriptBlock {
param ($DC)
Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\" -Name PortNumber | Select-Object PortNumber
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp\" -Name PortNumber -Value 3395
New-NetFirewallRule -DisplayName “Remote Desktop - User Mode (TCP-In) 3395” -Direction Inbound –Protocol TCP -Profile Any –LocalPort 3395 -Action allow
New-NetFirewallRule -DisplayName “Remote Desktop - User Mode (UDP-In) 3395” -Direction Inbound –Protocol UDP -Profile Any –LocalPort 3395 -Action allow
[ValidateSet('Yes','No')]$Answer = Read-Host "`nAre you sure you want to restart $($DC.Name) ? Enter Yes/No"
If ($Answer -eq 'Yes') { Restart-Computer -Force }
 } -ArgumentList $DC
}

The above script will change the RDP listening port to 3395 for all servers in the OU named “Computers“, and finally it will create a new Firewall Rule to allow inbound remote access over TCP/UDP port 3395.

For the change to take effect, you need to restart the computer, thus I added a validate set variable to confirm if you want to restart the server now or later.

How To Change Remote Desktop (RDP) Port With PowerShell #RDP #PowerShell 2

Last but not least, you need to connect to the target machine by specifying the new RDP port.

i.e. mstsc /v 172.16.20.13:3395

Hope this helps!

Cheers,
-Charbel

Previous

The First System Center Semi-Annual Channel (SAC), Version 1801 Release Now Available

PowerShell One-Liner To Convert Multiple VHD to VHDX #HyperV #PowerShell

Next

2 thoughts on “How To Change Remote Desktop (RDP) Port With PowerShell #RDP #PowerShell”

Leave a comment...

  1. When you first mention mac rdp ports (first 2 lines of introduction) you mention same port as windows port…3389 instead of 3395 what you use in script to change port.

  2. Hello Tim, thanks for the comment. Yes, Microsoft claimed long time ago that “the Remote Desktop Connection Client for the Mac supports only port 3389″. However, this is not correct. You can change the RDP port on any Windows machine as described in this article and then connect from your MAC machine to Windows (e.g. 10.10.10.10:3395). Hope it’s clear now.

Let me know what you think, or ask a question...

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Subscribe to Stay in Touch

Never miss out on your favorite posts and our latest announcements!

The content of this website is copyrighted from being plagiarized!

You can copy from the 'Code Blocks' in 'Black' by selecting the Code.

Please send your feedback to the author using this form for any 'Code' you like.

Thank you for visiting!