Network ports · 3389
3389 — RDP
Port 3389 is Microsoft Remote Desktop, a frequent target for brute force and ransomware.
Key facts
| Port | 3389 |
|---|---|
| Transport | TCP, also UDP |
| Service | Remote Desktop Protocol |
| Encryption | TLS or CredSSP |
| Exposure | High risk if public |
| Range | Well-known (0–1023) |
Why RDP gets attacked
RDP provides an interactive desktop with the privileges of the logged-in user. Internet-wide scanners look for 3389 continuously, and stolen credentials are traded and reused. A successful login can lead directly to data theft or ransomware deployment.
Even with TLS, the login endpoint is reachable and can be brute-forced or attacked through credential stuffing unless access is restricted.
Safer access patterns
Put RDP behind a VPN or a zero-trust gateway, require multi-factor authentication, and restrict source addresses. Enable Network Level Authentication, lock out repeated failures and monitor successful logins from new locations.
Never forward 3389 directly from the internet. If a business requirement seems to demand it, the requirement is really for remote access, and a VPN satisfies it with far less exposure.
Frequently asked questions
Is RDP encrypted?
Modern RDP uses TLS or CredSSP, but encryption does not prevent brute force or stolen-credential access.
Can I change the RDP port?
Yes, but scanners find it anyway. Restrict network access instead of relying on a different port.