Free Trial is currently available for our Business Plans.
Please choose an option that meets your trial needs below
$15 per user per month
Starts at 20 Users / unlimited computers
No credit card required
$2.22
per computer per month
Minimum 20 Computers
No credit card required
Compare all plans & features on the Pricing page
Port 3389 is the default port used by Microsoft Remote Desktop Protocol, on both TCP and UDP. Any machine with Remote Desktop enabled listens there, and internet-exposed RDP services are routinely discovered by automated scanning and targeted with credential attacks.
Anything listening on a public port gets found by automated scanning, whether or not anyone is deliberately looking for it.
The full RDP session: authentication, display, input, and redirected devices. TCP 3389 carries the connection setup and is the fallback transport; UDP 3389 accelerates graphics when available. RD Gateway changes the picture by wrapping RDP in HTTPS over TCP 443 (with UDP 3391 optional), so 3389 never faces the internet directly.
No, not meaningfully. Moving RDP to a non-standard port hides it from the laziest scans only. Modern scanners fingerprint services across every port regardless, and the RDP handshake gives itself away the moment it responds. Port-changing is security by obscurity: it cuts down log noise, not actual risk. Credential-based attacks are not meaningfully prevented by changing the port number.
Traffic over 3389 is encrypted. Modern RDP negotiates TLS, and Network Level Authentication protects the logon sequence on top of that. None of that makes exposure safe, though. Attackers do not bother breaking the cryptography; they guess or steal a credential and just walk in the front door. Details: Is RDP encrypted? →
Exposed 3389 endpoints face password spraying, credential stuffing, and the occasional exploited protocol vulnerability, BlueKeep in 2019 being the most infamous example. Exposed RDP remains a recurring initial-access and lateral-movement risk in ransomware incidents. An internet-facing RDP listener should be assumed to be discoverable by automated scanning and exposed to ongoing attack attempts.
Four patterns exist, each eliminating more exposure than the last. Restrict 3389 to specific source IPs, which is fragile and breaks the moment someone works from a mobile connection. Place RDP behind a VPN, which hides 3389 but hands out network-level access and just moves the exposure onto the VPN concentrator instead. Publish through RD Gateway, which moves exposure to one hardened HTTPS endpoint. Or use an outbound-brokered Zero Trust model, where no inbound port at all, not 3389, not 443, nothing, is ever open, because every connection originates from inside the network. Why open inbound ports are the real problem to begin with: Do not open that firewall port →
Remote Desktop Protocol. It is how you remote-control a Windows machine.
CISA guidance recommends avoiding direct web exposure of RDP services, or strictly restricting access when exposure is unavoidable.
External scanning of the public IP range, or search engines such as Shodan, reveal listening RDP endpoints.
Where TruGrid fits. TruGrid SecureRDP establishes remote desktop sessions with zero inbound ports open. 3389 stays closed at the firewall. See how →
TruGrid SecureRDP delivers Zero Trust remote desktop access: MFA, least privilege, and zero open inbound ports.
Explore SecureRDP →
TruGrid simplifies Access and Device Security for organizations by reducing complexity and associated costs.
