How do I kill the process using port 3389?

On macOS & Linux, run: "sudo systemctl stop xrdp". On Windows PowerShell (as Admin), run: "Stop-Service TermService -Force".

Why am I getting "port 3389 already in use" (EADDRINUSE)?

This occurs when another background instance of TermService (svchost.exe), xrdp or a zombie process is already bound to port 3389. Use the kill commands above to free the port immediately.

Networking

Risk: Critical

Port 3389 — RDP (Remote Desktop Protocol)

Q: Is Port 3389 safe to expose to the public internet?

Risk level is Critical. Port 3389 is the single most targeted port on the internet for automated brute-force attacks and credential stuffing. NEVER expose port 3389 directly; always require a VPN, WireGuard, or bastion jumpbox with MFA.

Port 3389 is the Microsoft Remote Desktop Protocol (RDP) listening port, enabling graphical desktop access and terminal server management on Windows and Linux (xrdp) hosts.

PORT NUMBER

3389

PROTOCOL

TCP/UDP

DEFAULT PROCESS

TermService (svchost.exe), xrdp

FIREWALL TARGET

3389/tcp/udp

Instant Terminal Fixes for Port 3389

macOS & Linux Terminal

1. Check who is listening on port 3389:

sudo lsof -i :3389 || sudo ss -tulpn | grep ":3389 "

2. Kill process occupying port 3389 (EADDRINUSE fix):

sudo systemctl stop xrdp

3. UFW Firewall Allow rule:

sudo ufw deny 3389/tcp

Windows PowerShell (Admin)

1. Check listening port:

Get-NetTCPConnection -LocalPort 3389

2. Force kill process on port 3389:

Stop-Service TermService -Force

3. Docker Port Forwarding Mapping:

docker run -d -p 3389:3389 scottyhardy/docker-remote-desktop

Common Error Encountered

Remote Desktop can't connect to the remote computer for one of these reasons on port 3389.

Security Advisory & Hardening

Port 3389 is the single most targeted port on the internet for automated brute-force attacks and credential stuffing. NEVER expose port 3389 directly; always require a VPN, WireGuard, or bastion jumpbox with MFA.

Frequently Asked Questions

Port 3389 Questions & Answers

Common questions regarding default services, kill commands, and firewall configurations.

Port 3389 is commonly used for RDP (Remote Desktop Protocol). Port 3389 is the Microsoft Remote Desktop Protocol (RDP) listening port, enabling graphical desktop access and terminal server management on Windows and Linux (xrdp) hosts.

Explore Other Developer Ports

View All Ports Directory

Port 3000React Port 8080HTTP Alternate Port 5173Vite Dev Server (Vue, Svelte, React)Port 80HTTP (Hypertext Transfer Protocol)Port 443HTTPS (HTTP over TLS Port 5000Flask