Port 3389 – RDP

TCP

Port 3389 is the RDP (Remote Desktop Protocol) port for Windows remote desktop access. RDP on port 3389 is the second most attacked port on the internet after SSH. Exposing RDP directly enables brute-force attacks, BlueKeep (CVE-2019-0708) exploitation, and ransomware deployment. Always use VPN or RD Gateway – never expose port 3389 directly.

Port Number

3389

Protocol

TCP

Service

Remote Desktop Protocol

Range

IANA Registered (1024–49151)

Description

Remote Desktop Protocol on port 3389 provides graphical remote access to Windows systems. RDP supports Network Level Authentication (NLA), TLS encryption, RemoteFX for GPU acceleration, and multi-monitor configurations. It is the primary remote administration tool in Windows environments. Port 3389 exposed to the internet is the single most common ransomware entry point. Attackers brute-force credentials or exploit vulnerabilities like BlueKeep to gain initial access, then deploy ransomware across the network. Mitigations: use RD Gateway (port 443) or VPN for remote access, enable NLA to require pre-authentication, enforce account lockout policies, and monitor for anomalous RDP sessions. If RDP must be accessible, at minimum change the port and implement IP allowlisting.

Security risks

1CVE-2019-0708 (BlueKeep): Pre-authentication RCE in RDP – wormable, allows full system compromise without credentials. Affected Windows XP through Server 2008 R2 (CVSS 9.8)
2#1 ransomware entry vector: exposed RDP (port 3389) is the primary initial access method for ransomware groups (Conti, LockBit, BlackCat) – brute-force or purchased credentials from credential markets
3NLA bypass techniques: older Windows versions without Network Level Authentication allow attackers to reach the login screen without valid credentials, enabling lock screen exploits
4Credential brute-force: RDP has no built-in rate limiting. Attackers run hydra/crowbar against exposed 3389 endpoints with credential lists (username:password from data breaches)
5Clipboard hijacking: RDP clipboard sharing enables malware on the remote session to read/modify clipboard content (including passwords being pasted by the admin)

Firewall guidance

NEVER expose port 3389 directly to the internet. This is the single highest-risk action for a Windows server. Use: (1) VPN + RDP (WireGuard/OpenVPN tunnel first), (2) RD Gateway on 443 (TLS + authentication before RDP), (3) Azure Bastion (managed jump host), or (4) Tailscale/ZeroTier mesh VPN. If you must expose: enable NLA, enforce MFA via Duo/Azure MFA, and IP-restrict.

Diagnosis commands

Extract Windows version, domain name, and hostname from RDP service

shell

nmap -p 3389 --script rdp-ntlm-info target

Check for BlueKeep-era RDP vulnerabilities

shell

nmap -p 3389 --script rdp-vuln-ms12-020 target

PowerShell: check if RDP is enabled (0=enabled, 1=disabled)

shell

Get-ItemProperty 'HKLM:\SYSTEM\CurrentControlSet\Control\Terminal Server' -Name fDenyTSConnections

List active RDP sessions on a Windows server

shell

qwinsta /server:target

Usage examples

Port 3389 – RDP

shell

mstsc /v:server:3389
xfreerdp /u:user /p:pass /v:server:3389
nmap --script rdp-enum-encryption -p 3389 target

Common services on this port

Windows Remote Desktopxrdp (Linux RDP server)Azure Virtual DesktopRD GatewayMicrosoft RDS (Terminal Services)

Related ports

3389

RDP (this port)

443

RD Gateway / RD Web Access (secure alternative)

3391

RDP alternate (sometimes used)

5985

WinRM (PowerShell remoting alternative)

History

RDP (Remote Desktop Protocol) was created by Microsoft in 1996, based on ITU T.128. Port 3389 was assigned for Terminal Services (now Remote Desktop Services). RDP became ubiquitous for Windows server administration. The 2020 pandemic massively increased RDP exposure as organizations enabled remote work hastily. BlueKeep (2019) and the constant ransomware campaigns via RDP made port 3389 the most dangerous port to expose after 445 (SMB).

FAQ

How do I secure RDP access?

Layered approach: (1) Never expose 3389 to internet (use VPN or RD Gateway). (2) Enable NLA (Network Level Authentication) – authenticates before session. (3) Enforce MFA (Duo, Azure AD Conditional Access). (4) Account lockout after 5 failures (secpol.msc → Account Lockout Policy). (5) Restrict via GPO: Computer Config → Admin Templates → Windows Components → Remote Desktop Services → allow only specific groups. (6) Enable Windows Defender Credential Guard (prevents credential theft from memory).

What is RD Gateway and how does it replace direct RDP?

RD Gateway (Remote Desktop Gateway) sits on port 443 (HTTPS) and authenticates users via TLS before establishing the RDP tunnel. Benefits: (1) Only port 443 exposed (not 3389), (2) supports Azure AD MFA / Conditional Access, (3) provides audit logging of all connections, (4) can enforce resource authorization (which servers a user can reach). Setup: install RD Gateway role, configure RAP/CAP policies, issue SSL certificate, point clients to gateway hostname.