RDP port open to the internet: what to check first
A public TCP response on port 3389, or an RDP-like response on a custom port, deserves prompt investigation. It tells you an endpoint responded; it does not prove someone logged in or that MFA is absent.
First, confirm what answered
Record the hostname, public IP, port, scan time and any service evidence. A custom port such as 12201 can lead to RDP, a gateway, a proxy or another service. Check the firewall or NAT rule and the destination server before assuming the port number tells you the whole story. If two internet connections publish the same service, review both public IPs.
Find the business owner and the path
- Ask who needs remote access, to which machine, and from where. Identify the vendor or staff member responsible.
- Inspect edge firewall and cloud security group rules. Check whether port forwarding sends traffic straight to a Windows host or through a controlled access service.
- Review server logs and remote access settings for expected use and suspicious activity. Do not disable an active business service without an access plan.
Reduce the exposure
If direct internet RDP is unnecessary, remove the public forwarding rule and confirm there is no alternate path through the second ISP. If remote access is necessary, place it behind a managed VPN or other access gateway with MFA and restrict authorized users and source networks. Keep the host and gateway maintained. Changing 3389 to a different port can lower casual noise, but it does not secure the service.
Test with an approved account from the intended access path, then check from an outside network that the unwanted public endpoint no longer responds. A Torva follow-up scan can record the externally observed change; the team must confirm the access policy, MFA configuration and logins separately.
What Torva can tell you
For verified domains, Edge checks 32 standard TCP ports plus your custom ports on public addresses, and tests for an RDP response on 3389 and on any other non-standard port it finds open, so RDP moved to an unusual port is still identified. Complete adds a weekly scan of all 65,535 TCP ports, so a moved RDP port is found even if you never added it as a custom port, and you get an alert email when a new port opens. A timeout is inconclusive. Edge does not log in to RDP, prove MFA enforcement, audit the server configuration or confirm which patches are installed.
Check your own domain. Try the public DNS, certificate and header instant check, then see Edge coverage for verified-domain scanning.
Further reading
Keep learning
Several hostnames, one IP address: how to read a security scan · A 20-minute weekly security review for a small IT team · All guides