3389 RDP TCP Flagship
Reference for TCP port 3389, commonly associated with RDP.
What it's for
Port 3389 is the default port for RDP (Remote Desktop Protocol), Microsoft's protocol for full graphical remote access to a Windows machine. Unlike SSH, which gives you a command-line shell, RDP streams an entire graphical desktop session — you see the remote machine's actual UI, move its mouse, type on its keyboard, and interact with it essentially as if sitting in front of it.
RDP is heavily used for remote IT administration of Windows servers, remote work setups connecting to office desktops, and cloud Windows VM access (Azure, AWS EC2 Windows instances almost always expose RDP for initial setup and ongoing administration).
Protocol basics
- Protocol: TCP, required for reliably streaming a continuous graphical session and input events.
- Encrypted by default (modern versions). Since Windows Server 2003 and later clients, RDP negotiates TLS encryption for the session, though older/legacy configurations could run without it — a real difference from Telnet-era protocols that were never encrypted at all.
- Network Level Authentication (NLA) requires the user to authenticate before a full remote desktop session is established, reducing the attack surface compared to authenticating only after the graphical session starts.
- Bandwidth-adaptive. RDP adjusts image quality and update frequency based on available bandwidth, which is why performance varies noticeably between a fast LAN connection and a slow home internet link.
Security considerations
- Port 3389 is one of the most attacked ports on the internet, second only to SSH's port 22 in terms of automated scanning and brute-force attempts — ransomware operators specifically scan for exposed RDP as an initial access vector.
- Never expose RDP directly to the public internet without additional protection. Best practice is requiring a VPN connection first, or putting RDP behind a bastion/jump host — direct internet exposure is one of the single most common causes of ransomware incidents in small-to-midsize businesses.
- Enable Network Level Authentication (NLA) — it's on by default in modern Windows, but verify it hasn't been disabled, since NLA meaningfully reduces the pre-authentication attack surface.
- Use strong, unique passwords and consider MFA — many RDP compromises stem from weak or reused credentials rather than a protocol-level vulnerability.
- Keep Windows patched. RDP has had critical, wormable vulnerabilities in the past (notably BlueKeep) that allowed remote code execution without authentication.
Troubleshooting
"Remote Desktop can't connect to the remote computer":
- Confirm port 3389 is open on the target machine's firewall and any network security group/appliance in between
- Verify Remote Desktop is actually enabled in the target machine's system settings (it's off by default on most Windows editions)
Connects but immediately disconnects:
- Often a licensing issue (RDP has a limit on simultaneous sessions depending on Windows edition/licensing) or an NLA/credential mismatch
Very slow/laggy remote session:
- Usually a bandwidth constraint — try lowering the color depth and disabling visual effects (wallpaper, animations) in the RDP client's display settings for a meaningful improvement on slower connections
"An authentication error has occurred" / CredSSP errors:
- Typically a mismatch in patch level between client and server around CredSSP security updates — ensure both systems are fully patched, not just one side
Comparison / FAQ
| Port | Protocol | Key difference from 3389 (RDP) |
|---|---|---|
| 22 (SSH) | TCP | Command-line access rather than a full graphical desktop, and cross-platform rather than Windows-specific |
| 5900 (VNC) | TCP | Cross-platform graphical remote access, but generally weaker built-in security than modern RDP |
| 445 (SMB) | TCP | File/printer sharing rather than full remote desktop access, though both are common Windows-network attack targets |
Is it safe to leave RDP open to the internet if I use a strong password?
No — a strong password helps, but exposed RDP is still one of the most targeted services on the internet, and vulnerabilities in the protocol itself (not just credential strength) have led to major incidents. Put it behind a VPN or bastion host instead.
What's the difference between RDP and VNC?
Both provide graphical remote desktop access, but RDP is Windows-native with more mature built-in security (encryption, NLA) by default, while VNC is cross-platform but historically has weaker default security, often requiring extra configuration to reach a comparable security baseline.
Why does Microsoft recommend NLA for RDP?
Network Level Authentication requires credentials to be verified before a full remote desktop session is established, meaning an unauthenticated attacker can't even reach the point of interacting with a login screen, significantly reducing the exposed attack surface.
Can I use RDP to connect to a Mac or Linux machine?
Not natively — RDP is a Microsoft protocol built around Windows, though third-party RDP server implementations exist for other operating systems. For native cross-platform remote desktop, VNC is the more common choice.