Port 3389 — RDP TCP/UDP Port

What port 3389 is used for

Remote Desktop Protocol — full graphical remote control of a Windows machine, used heavily for remote administration and remote work. Traditionally TCP-only, but modern Windows Server and RDP clients also use a UDP transport ("RDP Shortpath for managed networks") to reduce latency, especially over WAN/VPN connections — TCP remains the primary and fallback transport.

Is port 3389 encrypted?

Supports TLS-based encryption, but older/unconfigured setups can fall back to weaker legacy authentication that is much easier to attack.

Firewall & exposure considerations

The FBI's Internet Crime Complaint Center (IC3) has specifically warned that cyber actors increasingly exploit RDP for brute-force and credential-stuffing attacks as an initial-access vector for ransomware (see References below). Should be placed behind a VPN and never exposed directly to the internet.

Common questions about port 3389

Does RDP use TCP or UDP?

Both. Microsoft's Remote Desktop Services port list gives the standard RDP port as TCP and UDP 3389. Through a Remote Desktop Gateway, external clients connect on TCP 443 (and UDP 3391 for RDP over UDP), and the gateway then reaches internal hosts on TCP and UDP 3389. RDP Shortpath for managed networks, an Azure Virtual Desktop feature, uses a separate UDP listener, port 3390 by default.

Can the RDP port be changed from 3389?

Yes. Microsoft's port list notes the standard port can be configured to a different number on the host and the client. Doing so does not change the guidance CISA gives for RDP: restrict it, log and monitor login attempts, enforce account lockouts, and disable RDP ports that are not needed for a business purpose.

Is it safe to leave port 3389 reachable from the internet?

CISA's ransomware advisories treat this as a major risk: a 2021 advisory names phishing and brute-forcing unsecured RDP endpoints as the two most prevalent ransomware initial access vectors, and a 2022 advisory reports that MedusaLocker actors most often gained access to victims through vulnerable RDP configurations. Treat any RDP endpoint that is directly reachable from the internet as a high-risk exposure, and put it behind controls such as a VPN or gateway and multi-factor authentication.

Related guide: Common ransomware ports: what to check and close

Related ports

• SSH (the Linux/Unix equivalent)
• SMB (another common ransomware entry point)

References

• Microsoft [MS-RDPBCGR]: Remote Desktop Protocol Basic Connectivity and Graphics Remoting
• Microsoft Learn: RDP Shortpath for managed networks
• FBI IC3: Cyber Actors Increasingly Exploit RDP to Conduct Malicious Activity
• IANA registration for port 3389
• Microsoft Learn: Ports that are used by Remote Desktop Services
• CISA: Ransomware Awareness for Holidays and Weekends (AA21-243A)
• CISA: #StopRansomware: MedusaLocker (AA22-181A)
• CISA: Weak Security Controls and Practices Routinely Exploited for Initial Access (AA22-137A)

Look up any other port

Search the full IANA registry — all 6,100+ ports and 12,500+ protocol-specific records — on the Port Lookup tool.

Last reviewed: October 26, 2026. Data source: IANA Service Name and Transport Protocol Port Number Registry. Security and usage notes are this site's own editorial content, not official IANA data.