check if RDP is wide open to the internet

why rdp is the front door ransomware gangs love

remote desktop protocol is how windows lets you log into a machine from somewhere else. it's incredibly useful for sysadmins, incredibly convenient for working from home, and incredibly popular with attackers scanning the entire internet for port 3389 sitting wide open. this isn't a theoretical risk, exposed rdp is consistently one of the top initial access points for ransomware. if you manage any windows machine, or you're the "tech person" for a small office, this is a five minute check that can save you a very bad week.

step 1: check if rdp is even turned on

before you worry about exposure, confirm rdp is actually enabled. windows stores this in the registry under a value called fDenyTSConnections. the name is backwards from what you'd expect, so pay attention:

Get-ItemProperty "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections"

if the value is 0, remote desktop is enabled. if it's 1, it's disabled. a lot of machines have this turned on by default or by whoever set them up years ago and forgot about it. if you don't actually use rdp, this alone is worth fixing.

step 2: see if anything is listening on port 3389

next, check whether windows is actually listening for rdp connections on your local machine:

Get-NetTCPConnection -LocalPort 3389

this pulls up any active tcp connections tied to port 3389, the default rdp port. if you get results back showing a "listen" state, that means something is ready to accept rdp traffic. this is a local check, it tells you what your machine is doing, not what the internet can see. that's the next step.

step 3: test it from outside, like an attacker would

a listening port on your local machine doesn't automatically mean the internet can reach it. your router or firewall might be blocking it. you need to test from outside your network to know for sure. find your public ip first:

curl ifconfig.me

then, from a different network (your phone's hotspot works fine, or a cloud vm if you want to be thorough), scan that public ip for the rdp port:

nmap -p 3389 your.public.ip.here

if it comes back as open, your rdp service is reachable from anywhere on earth. that means every bot scanning the internet for port 3389 has already found you, whether or not anyone has tried to log in yet. if it shows closed or filtered, your firewall or router is doing its job and blocking inbound access.

step 4: fix what you find

this part is simple, it just depends on whether you actually need rdp exposed to the internet, which is almost never the right answer.

not using rdp at all? turn it off. set fDenyTSConnections back to 1, or disable it through system properties under remote settings. fewer open doors, fewer problems.

using rdp for legit remote access? never expose it directly to the internet. put it behind a vpn so you have to authenticate to your network before you can even attempt an rdp connection. enable network level authentication (nla) so credentials are verified before a full session is established, which blocks a chunk of automated attacks. and layer on mfa wherever your setup supports it, whether that's through the vpn, azure ad, or a third party tool. the goal is that port 3389 is never directly reachable by a random ip scanning the internet, full stop.

if you manage multiple machines or an office network, check your router or firewall rules too. sometimes rdp exposure isn't a windows setting at all, it's a port forwarding rule someone set up years ago to "make things easier" and never undid.

the takeaway

exposed rdp is one of those misconfigurations that sits quietly until it's the reason your whole network is encrypted. checking it takes a few minutes: confirm it's enabled, check if it's listening, scan your public ip from outside, then lock it down with a vpn, nla, and mfa, or just turn it off if you don't need it. run this check on your own systems today, and if you're the person who manages the office pcs, do it there too. nobody's going to send you a thank you note for this, but they'll definitely remember if you didn't.