Public port 3389 is continuously targeted by automated brute-force login attempts. Repeated failures can trigger Windows account lockouts and prevent RDP access, leaving the noVNC console as your recovery method. Moving RDP to a non-default port reduces routine scanning noise, but it is not complete protection. Keep a strong password, Network Level Authentication, Windows Firewall restrictions, and Windows updates enabled.
Change RDP from port 3389
Stay connected through noVNC and choose an unused high TCP port between 1024 and 65535 (for example, 33899). Verify that it is unused and record it.
Open Windows Defender Firewall with Advanced Security. Create an inbound Port rule for TCP on the new port, allow the connection, select the appropriate profiles, and give the rule a clear name such as RDP custom port.
Open Registry Editor as administrator and go to: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
Open PortNumber, select Decimal, enter the new port, and save the change.
Restart the VPS from Windows while keeping ARPHost Portal/noVNC access available.
Test RDP with YOURIP:YOUR-NEW-PORT. Verify the new connection before removing any custom firewall rule that allowed TCP 3389.
If the new port does not work, return through noVNC and verify the firewall rule and PortNumber, or restore 3389.
