Knowledge base · remote access
RDP exposed to the internet: why port 3389 is a serious risk
Remote Desktop Protocol is useful for administration and remote work, but direct internet exposure significantly increases the public attack surface. Automated scanners quickly find the service, even when RDP uses a non-standard port.
Updated: 3 September 2026
What can an attacker see?
An open TCP port 3389 can reveal that a Windows host or Remote Desktop Gateway is reachable. Depending on the configuration, certificate names, authentication properties and other characteristics may also be visible. Moving RDP to another port can reduce noise in simple logs, but it is not a meaningful security control because scanners inspect far more than the default port.
An open port alone does not prove that a vulnerability exists. It does mean the service is internet-accessible and must therefore be intentionally configured, patched and monitored.
What risks does this create?
A public RDP service attracts automated login attempts, password spraying and the use of stolen credentials. Without multifactor authentication, one reused or leaked password may be enough. Outdated systems also create risk when vulnerabilities in the RDP stack or underlying Windows components can be exploited.
Successful access often provides more than a desktop. Depending on privileges, an intruder may copy data, disable protection, reach other systems or deploy ransomware. Remote access should therefore be treated as an entry point to the business network.
What is a safer design?
Avoid exposing individual RDP hosts directly to the internet. Put remote access behind a properly managed VPN, zero-trust solution or Remote Desktop Gateway. Microsoft describes RD Gateway as a way to provide access to internal RDP resources through an encrypted tunnel and central authorisation.
Add multifactor authentication, restrict the users and devices that may connect and avoid unnecessary administrative privileges. Use Network Level Authentication, apply security updates promptly and remove unused accounts and rules. Record successful and failed sign-ins centrally and investigate unusual patterns.
If direct RDP access is temporarily unavoidable
Restrict source addresses with firewall allowlists, enforce strong unique passwords and account lockout, and place MFA in front of the RDP session wherever possible. Keep the system fully patched, enable NLA and permit only the required accounts. Review whether drive, clipboard and device redirection are genuinely necessary.
These controls reduce risk, but they do not make a directly published RDP host equivalent to a properly designed gateway or VPN solution. Plan to replace the temporary arrangement structurally.
How does JotaSec check RDP exposure?
During an External Exposure Scan, JotaSec checks which services are reachable within the agreed written scope. For RDP, the review considers not only the port number but also the likely service, visible configuration and relevant context. Validation is non-destructive and does not involve unauthorised login attempts.
You receive evidence, a practical risk assessment and concrete remediation actions. One retest is included after remediation to confirm that the agreed exposure has actually been reduced.
Technical sources
Is RDP reachable from the internet?
Have your remote access and other publicly reachable services reviewed in a controlled way.