I installed fresh copies of Windows 11 Pro on three Lenovo ThinkCentre Tiny computers. They are configured similarly: private network profile, network discovery and file sharing enabled, fixed IP addresses with router reservations, and Remote Desktop configured to require NLA.
For security and possible future use, I changed the RDP listening port in the registry at HKEY_LOCAL_MACHINESystemCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp. I also created a Windows Defender Firewall inbound rule allowing TCP traffic on the custom port and disabled the default Remote Desktop TCP rule for port 3389.
Two computers accept RDP connections normally using the custom port, but the third does not. The third computer does work when I restore the registry setting to 3389, disable the custom rule, and re-enable the default 3389 rule. I have restarted the computers, and netstat confirms that the custom port is listening on the problem machine.
What else should I check to determine why only this computer refuses RDP on the custom port?
4 Answers
Check the RDP and Terminal Services event logs on the affected computer and look at the exact client error. A timeout usually points to filtering somewhere, while an authentication error suggests an NLA, account, domain, cloud-join, or workgroup issue. Also confirm that no security suite or other network-filtering software was installed on this machine but not the others.
Using a custom port does not make RDP safe to expose directly to the internet. If remote access is ever needed, use a VPN or another properly secured gateway and restrict access with firewall rules, accounts, and MFA where possible. For LAN-only access, the custom port may be unnecessary; the important troubleshooting step is identifying why the affected machine behaves differently from the other two.
First determine whether the issue follows the port number or the computer. Assign the working machines’ port numbers to the problem computer and give the problem computer’s port to one of the working machines. If the failure follows the port, look for a collision or another service using it. If it follows the hardware, focus on that machine’s firewall, security software, or configuration.
Although netstat shows the port in a listening state, test the port locally and from another computer with Telnet or PowerShell, for example Test-NetConnection -ComputerName -Port . This helps separate an RDP service problem from a firewall or network-path problem. Restarting the Remote Desktop Services service, or rebooting after changing the registry, is also important.
The three systems are fresh installations and do not have additional security software. I’ll check the event logs and may temporarily test with the firewall disabled on both computers, only while they are isolated from the network.