Port 3389 isthe home of the remote desktop protocol that powers Remote Desktop Serviceson all modern versions of Windows. If your system has Remote Desktop enabled, it is listening for connections on port 3389. Since this port is both well known and can be used to attack accounts, it is low hanging fruit for script kiddies and bots looking for an easy target.
Theoreticallyon a system that does not have an account lockout policy in place, which by the way is not a system default, the RDPprotocol can be used to get the administrator passwordwithbrute force. Brute forceis a fancy way of saying trying all possible passwords. If the system never locks out the account then time is the only barrier to eventually getting you password and logging in.
The first defense is to implement a good account lockout policybut that does not solve the entire problem. Any administrator of a public facing Windows web server will notice that their server is continiously attacked by bots looking for an easy target. The bots will often lock out your accounts which can be very annoying.
To protect your system from the bots and script kiddies I always reccomend changing the default RDP port. This will not fool an intelligent attacker but itwill weed out the noise.
Follow these steps to change the Remote Desktop server port:
- Open up Registry Editor by clicking on the Start Button, type in regedit and then hit Enter.
- In Registry Editor, navigate to HKEY_LOCAL_MACHINE, SYSTEM, CurrentControlSet, Control, Terminal Server, WinStations and RDP-Tcp.
- Right click onthe PortNumber dword and select Modify.
- Change the base to Decimal and enter a new port between 1025 and 65535 that is not already in use.
- Click OK and reboot.
Make sure to reboot to activate the change.
Keep in mind that the next time you want to connect to your system with RDP you will need to provide the port number. You can do that from the Remote Desktop client by appending a colon after the host name or ip address followed by the port number. For example, if I have a computer with host name of tweak with RDP running on port 1234 I would use tweak:1234 in the remote desktop client hostname field.