High risk Port 3389 · Remote Desktop (RDP)

Port 3389 is open: what it means and how to fix it

By Stephane Meus, CEH, PenTest+ · Updated 11 October 2026 · 6 minute read

What is port 3389?

Port 3389 is the network port used by the Remote Desktop Protocol (RDP). RDP lets someone see and control a Windows computer or server as if they were sitting in front of it. It is built into Windows, which is why it shows up so often on small business networks: someone turned it on so they could work from home, or so an IT provider could help remotely, and a router rule made it reachable from outside.

Being open inside your office network is normal. The problem is when it answers from the public internet, which is what an external scan like FreshScanSentry's checks.

Why an open port 3389 is high risk

• It is constantly attacked. Internet-wide scanners find exposed Remote Desktop within hours of it going online. Bots then try common usernames and leaked passwords around the clock.
• One guessed password gives full control. RDP is not a website login. A successful guess puts the attacker on the desktop of a machine inside your network, often with access to shared drives and other computers.
• Ransomware groups rely on it. Joint CISA and FBI #StopRansomware advisories repeatedly list compromised RDP as an initial access method, including for the Royal, MedusaLocker and Medusa ransomware groups.
• RDP has had serious flaws. BlueKeep (CVE-2019-0708) let attackers take over unpatched older Windows systems through RDP without any password. Patches exist, but unpatched machines are still found online.

How to confirm it is really open

The test has to come from outside your network. Testing from a computer in the office only shows what's open on the office network.

1. Run a free external scan. A FreshScanSentry Basic Scan of your public IP address or domain checks it from the internet and tells you which service is answering.
2. Or use Nmap from another connection, such as a phone hotspot, against your public IP address:

   nmap -p 3389 -sV your-public-ip

   open with the service ms-wbt-server means Remote Desktop is reachable. To see whether it requires Network Level Authentication:

   nmap -p 3389 --script rdp-enum-encryption your-public-ip

3. Find out which machine it points to. Log in to your router or firewall and look for a port forwarding (NAT) rule for 3389, or any rule that forwards another outside port to 3389 on an inside computer. In the cloud (Azure, AWS), look for a security group or network rule that allows 3389 from 0.0.0.0/0 or "Any".

Only scan addresses you own or have written permission to test.

How to fix it

Work down this list. Most small businesses can stop after step 1 or step 2.

1. If nobody needs remote access: close it

• Delete the port forwarding rule for 3389 on your router or firewall. This is the single most effective fix.
• In the cloud, remove the inbound rule that allows 3389 from anywhere.
• If Remote Desktop isn't used at all, turn it off on the computer: Settings → System → Remote Desktop → Off.

2. If people do need remote access: put it behind something

• VPN. Staff connect to a VPN first, then use Remote Desktop over it. Port 3389 is no longer reachable from the internet. Most business firewalls include a VPN.
• Remote Desktop Gateway (Windows Server) or a zero-trust access service. These put a login with multi-factor authentication in front of RDP.
• In the cloud, use the provider's bastion or just-in-time access feature, or restrict the rule to your office's fixed IP address only.

3. Harden Remote Desktop itself

These don't replace step 2, but they reduce the damage if something gets through.

• Require Network Level Authentication (NLA), so users must log in before a remote session starts. It is on by default in current Windows versions; check it hasn't been turned off.
• Set an account lockout policy, so repeated wrong passwords lock the account for a while.
• Use long, unique passwords and remove or rename unused accounts, especially any named "admin" or "administrator".
• Install Windows updates, and replace systems that no longer receive them.
• Limit who can use it. Only accounts in the "Remote Desktop Users" group should be able to log in remotely.

4. Re-scan to confirm

Run another external scan after the change. Port 3389 should no longer appear, and your exposure grade should go up.

What doesn't work

• Moving RDP to a different port (3390, 33890, and so on). It cuts down some automated noise, but Nmap's -sV identifies Remote Desktop on any port in seconds. It is still exposed.
• Relying on a strong password alone. It helps against guessing, but not against stolen passwords or flaws like BlueKeep.

If you think someone already got in

Signs include unknown user accounts, logins at odd hours in the Windows Security event log (event ID 4624 with logon type 10 means a Remote Desktop login), new software you didn't install, or antivirus that has been turned off. Disconnect the machine from the network and contact an incident response provider before changing anything else, so evidence isn't lost.

Common questions

Is it ever fine to leave 3389 open?

Not to the whole internet. Allowing it only from one fixed, trusted IP address is acceptable for some setups, but a VPN or gateway is safer and easier to keep right.

My IT provider says they need it open.

Ask them to use a VPN, a Remote Desktop Gateway, or their remote support tool instead. Most managed service providers already have one of these.

The scan found 3389 but we don't use Remote Desktop.

Then something is forwarding that port, or a computer has RDP turned on without anyone knowing. Follow "How to confirm" above to find which machine it points to, then close it.

Sources: CISA #StopRansomware · CISA and FBI advisory on Royal ransomware (AA23-061A) · NVD: CVE-2019-0708 (BlueKeep) · Nmap rdp-enum-encryption