What is port 3389 used for?
Port 3389 is RDP, the Remote Desktop Protocol. It shows a Windows computer's full desktop on another machine, and is how administrators manage Windows servers and how help desks and remote workers reach PCs.
An RDP server reachable from the internet is one of the first things automated scanners look for: they find port 3389 and try passwords without pause. Changing the port number only hides it from casual scans. The effective measures are to keep 3389 closed at the internet edge and reach it through a VPN or gateway, to require Network Level Authentication so that users must authenticate before a desktop session is created, and to add multifactor authentication and account lockout.
Is port 3389 TCP or UDP?
Both. RDP listens on TCP 3389, and Windows also lists UDP 3389 for Remote Desktop Services, which current versions use alongside TCP to keep the session responsive on poor connections.
Is RDP on port 3389 secure?
RDP encrypts the session, so the weak point is exposure, not eavesdropping. Do not publish 3389 to the internet: place it behind a VPN or gateway, and require Network Level Authentication, which makes the user authenticate before the server sets up a session.
Port 3389 vs port 5900: what is the difference?
Both give remote graphical access. Port 3389 is Microsoft's RDP, built into Windows, which signs you in to a Windows session. Port 5900 is VNC (the remote framebuffer protocol), which shares the screen that is already displayed and works across operating systems.
Which CompTIA exams list port 3389?
CompTIA lists port 3389 by number in both the Network+ and the A+ Core 1 objectives.
- Network+ N10-009: objective 1.4 (Networking Concepts), listed as “Remote Desktop Protocol (RDP), 3389”.
- A+ Core 1 220-1201: objective 2.1 (Networking), listed as “3389, Remote Desktop Protocol (RDP)”.
The quoted text is how the objectives document lists the port. The exam puts the port in a scenario, such as a firewall rule or a failed connection; it does not only ask for the number.
Check yourself: a practice question
Written by CertSprint for this page. It is not taken from any exam.
A small company forwards port 3389 from its internet router to an office PC so the owner can work from home. Which change reduces the risk most?
- Remove the port forward and connect through a VPN first
- Change the PC's wallpaper
- Move RDP to port 3390 and keep the forward
- Disable the PC's screen saver
Show the answer
A. Remove the port forward and connect through a VPN first. With a VPN, RDP is no longer reachable by the whole internet. Moving the port only delays discovery by scanners.
Sources: IANA Service Name and Transport Protocol Port Number Registry: port 3389; Microsoft Learn: Change the listening port for Remote Desktop; Microsoft Learn: Service overview and network port requirements for Windows; Microsoft Learn: Enable Remote Desktop on your PC; RFC 6143: The Remote Framebuffer Protocol. The port number and how each exam lists it come from CompTIA's exam objectives, linked from the study plans above. The explanation and the question are CertSprint's own, checked against these sources on 12 November 2026.