Fix RDP lockout caused by brute-force attacks

Your Windows account keeps locking? Bots scan the internet and guess passwords on the default RDP port 3389. This tutorial explains the mechanism and how to change the Remote Desktop port for stable access.

See also: Connect via RDP · Secure RDP

📋 Prerequisites

• Windows VPS with Administrator access (active RDP session)
• Working RDP connection before changes

What is going on?

The default RDP port is 3389. Bots know it and scan it continuously. After many failed login attempts, Windows locks the account.

Default RDP port (3389) — attack in progress
Internet bots
admin / 123456✕
admin / password✕
admin / qwerty✕
… × 500 attempts✕
Windows VPS
Port 3389Account locked
You
Connection denied
Connection denied

After changing the port, bots no longer find RDP on 3389:

Custom port (e.g. 3390) — bots blocked
Internet bots
Port 3389
Port closed
Scan fails
You
Port 3390
Windows VPS
Connected

Step 1 — Change the port in the registry

Open PowerShell as Administrator:

PowerShell
Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp" -Name PortNumber -Value 3390

Replace 3390 with your chosen port (1024–65535).

Via regedit:

1. Win + R → regedit
2. Go to HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
3. Double-click PortNumber → select Decimal → enter 3390 → OK

Step 2 — Open the new port in the firewall

PowerShell
New-NetFirewallRule -DisplayName "RDP Custom Port" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Allow

See also: open a Windows firewall port.

Step 3 — Restart the RDP service

PowerShell
Restart-Service TermService -Force

Step 4 — Connect with the new port

In Remote Desktop, use:

TEXT
YOUR_IP:3390

Example: 82.26.157.98:3390

Step 5 — Block the old port (optional)

After confirming the new connection:

PowerShell
New-NetFirewallRule -DisplayName "Block RDP 3389" -Direction Inbound -Protocol TCP -LocalPort 3389 -Action Block

Verify

PowerShell
netstat -an | findstr "3390"

Expected:

TEXT
TCP    0.0.0.0:3390    0.0.0.0:0    LISTENING

Go further

Restrict access to your fixed public IP only:

PowerShell
New-NetFirewallRule -DisplayName "RDP My IP" -Direction Inbound -Protocol TCP -LocalPort 3390 -RemoteAddress "YOUR_IP_HERE" -Action Allow
New-NetFirewallRule -DisplayName "RDP Block Rest" -Direction Inbound -Protocol TCP -LocalPort 3390 -Action Block

Only if your IP is static — otherwise you may lock yourself out.

Summary

Secure RDP access! 🚀