Windows 11 Pro — RDP not listening on port 3389

Question

Windows 11 Pro — RDP not listening on port 3389

Alain Jennotte 0

What I tried already...

Remote Desktop enabled in Settings
TermService : Running
fDenyTSConnections : 0
PortNumber : 3389
Firewall disabled (all profiles)
NetworkCategory : Private
netstat -an | findstr 3389 : no output
Reboot attempted : no change
Cannot stop/restart TermService even as admin

Is there a solution for me?

0 comments

2 answers

Your answer

Answer 1

Welcome to Microsoft Q&A!

Thank you for providing the troubleshooting details.

Based on the information shared, this does not appear to be a firewall issue. When Remote Desktop is enabled, TermService is running, fDenyTSConnections = 0, but netstat -an | findstr 3389 returns no output, it typically indicates that the RDP listener (RDP-Tcp) has failed to initialize, preventing Windows from binding to port 3389 and accepting Remote Desktop connections. The most common areas to investigate are:

Verify that the RDP-Tcp listener exists and is in a Listen state. If the listener is missing or not listening, port 3389 will not be opened. It is a recommendation checking the listener status as part of standard RDP troubleshooting.
Confirm that both Remote Desktop Services (TermService) and Remote Desktop Services UserMode Port Redirector (UmRdpService) are running. RDP connectivity depends on both services being available, and cases have been observed where the listener was not created even though TermService appeared to be running.
Check whether a Group Policy setting under: HKLM\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services

Is overriding the local Remote Desktop configuration. Policy settings take precedence over local registry values and can prevent the RDP listener from starting even when fDenyTSConnections is set to 0.

Review the TerminalServices-RemoteConnectionManager and TerminalServices-LocalSessionManager event logs. These logs identified as the primary source for listener startup and initialization failures.
Verify the Remote Desktop certificate. A missing, expired, invalid, or inaccessible RDP certificate can prevent the RDP listener from starting. Both list certificate-related issues and MachineKeys permissions as common causes of listener failures.
Consider service permission or security descriptor issues. TermService reports as running but the RDP listener fails to start due to access-denied conditions or corrupted service permissions, resulting in no listener on port 3389.

In short, the next area of focus should be the RDP listener configuration, Group Policy settings, certificate health, service permissions, and Terminal Services event logs, rather than firewall or network troubleshooting, since the system is currently not listening on TCP port 3389.

For further information, please visit: General Remote Desktop connection troubleshooting - Windows Server | Microsoft Learn

Guidance for troubleshooting RDS session connectivity - Windows Server | Microsoft Learn

Remote Desktop Can't Connect to the Remote Computer - Windows Server | Microsoft Learn

If the information provided is helpful, please click Accept Answer.

Thank you for choosing Microsoft Q&A!

Answer 2

Yes. Since PortNumber is 3389 but netstat shows no listener, the next checks are the RDP-TCP listener state, required services, registry values tied to the listener, and port conflicts.

Verify the RDP-TCP listener exists and is in Listen state. Run:
```
   qwinsta
```
Expected result: a line like rdp-tcp ... Listen.
If rdp-tcp is missing or not Listen, check these registry values. Warning: registry changes are risky. Back up the registry first.
- Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
  - fEnableWinStation must be 1
- Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
  - fDenyTSConnections must be 0
- If configured by policy, also check:
  - Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
  - fDenyTSConnections must also be 0 Policy values override default values.
Confirm both required services are running.
- Remote Desktop Services (TermService)
- Remote Desktop Services UserMode Port Redirector (UmRdpService) If either service fails to start, Microsoft recommends contacting Support.
Check whether another process is using port 3389. Run in an elevated Command Prompt or PowerShell:
```
   tasklist /svc | findstr TermService
   netstat -anob | findstr 3389
```
The PID for TermService should match the PID listening on port 3389. If it does not match, stop the process using 3389, then restart TermService.
Check the RDP self-signed certificate.
- Open the Certificates MMC snap-in.
- Manage the Computer account for the affected computer.
- In Certificates under Remote Desktop, delete the RDP self-signed certificate.
- Restart Remote Desktop Services.
- Refresh the snap-in and confirm the certificate is recreated.
Check for unnecessary Remote Desktop Services roles. In Server Manager > Manage > Remove Roles and Features > Server Roles > Remote Desktop Services, remove unnecessary roles if present, then restart the machine.
If the listener still does not work, check these additional conditions.
- Add Network Service to the local Administrators group, then restart TermService:
```
     Add-LocalGroupMember -Group Administrators -Member "Network Service"
```
- In Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup, confirm both values are 0:
  - SystemSetupInProgress
  - OOBEInProgress
Last registry repair step if the listener is broken. Warning: this is disruptive and can prevent RDP access while the key is missing. Export Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp from a working machine with the same Windows version, back up the existing key on the affected machine, then replace it.
If qwinsta shows rdp-tcp is working and connectivity is otherwise good, but the issue remains, contact Microsoft Support.