DEV Community

Latchu@DevOps
Latchu@DevOps

Posted on

💥 Unlock Dual RDP Access on Windows EC2 — Securely with SSM Fleet Manager + Custom Port

#ec2 #devops #aws #beginners

Managing secure access to production Windows EC2 instances is a common challenge in cloud environments. While AWS SSM Fleet Manager uses the default RDP port 3389, you might want to allow manual RDP access using a custom port (like 7339) — especially for Bastion jump host access, maintenance, or upgrade tasks.

This guide walks you through configuring both ports — with minimal risk and maximum control.

🎯 Use Case

✅ Port 3389 → Reserved only for AWS SSM Fleet Manager RDP
✅ Port 7339 → Used for manual RDP access via Bastion/admin tools

🛠️ Step-by-Step: Enable Dual RDP Ports on Windows Server

🔹 Step 1: Open Registry Editor

Press Win + R, type regedit, and press Enter.

Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
Enter fullscreen mode Exit fullscreen mode

🔹 Step 2: Export the Original RDP Listener Key

  1. Right-click the RDP-Tcp key.
  2. Choose Export.
  3. Save two copies: 
RDP-Tcp-Original.reg (backup)
RDP-Tcp-New.reg (which you'll edit)
Enter fullscreen mode Exit fullscreen mode

🔹 Step 3: Edit the REG File (Clone and Modify Port)

Open RDP-Tcp-New.reg in Notepad.
Change this line:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp]
Enter fullscreen mode Exit fullscreen mode

to:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp-7339]
Enter fullscreen mode Exit fullscreen mode

Find the port setting:

"PortNumber"=dword:00000d3d
Enter fullscreen mode Exit fullscreen mode

Replace it with your custom port (7339 in hex = 1CA3):

"PortNumber"=dword:00001ca3
Enter fullscreen mode Exit fullscreen mode

🔹 Step 4: Import the Modified REG File

  • Double-click the edited RDP-Tcp-New.reg file.
  • Click Yes to allow registry merge.
  • This creates a new listener: RDP-Tcp-7339

🔹 Step 5: Allow the Custom Port in Windows Firewall

  • Open Windows Defender Firewall with Advanced Security.
  • Navigate to Inbound Rules > New Rule.
  • Choose: 
Rule Type: Port
Protocol: TCP
Port: 7339
Action: Allow the connection
Profile: Domain, Private, Public
Name: RDP Port 7339 Allow
Enter fullscreen mode Exit fullscreen mode

🔹 Step 6: (Optional) Block 3389 from External Access

To prevent public RDP via 3389 (while still allowing SSM Fleet Manager access):

  1. Go to Windows Firewall > Inbound Rules.
  2. Find the rule allowing RDP on 3389.
  3. Either: 
Disable it (if not needed externally)
Or edit the scope to allow only AWS internal IPs
Enter fullscreen mode Exit fullscreen mode

🛑 Do NOT block 3389 entirely if you use SSM RDP — Fleet Manager needs it!

🔹 Step 7: Reboot the Server

Restart-Computer
Enter fullscreen mode Exit fullscreen mode

🔹 Step 8: Test RDP Access

From your admin workstation or Bastion:

RDP > <your-ec2-ip>:7339
Enter fullscreen mode Exit fullscreen mode

✅ You should now see a login prompt!

🔐 Security Best Practices for Dual RDP Ports

Port Purpose Security Recommendation
3389 AWS Fleet Manager (SSM RDP) Keep it open only for AWS IP ranges
7339 Manual RDP via Bastion/Admin Restrict using Security Groups + Firewall
Both Registry listeners Monitor with netstat or PowerShell

✅ Bonus Checks:

  • Ensure both ports are listening: 
netstat -an | findstr LISTENING
Enter fullscreen mode Exit fullscreen mode
  • Keep Security Groups tight — only allow 7339 from: 
Bastion host
Admin IPs (office VPN, specific jump host)
Enter fullscreen mode Exit fullscreen mode

🧠 Final Thoughts

This approach allows:

  • Secure, automated access via SSM Fleet Manager
  • Manual RDP control when needed — without exposing 3389 to the world

It's a great balance between automation and manual override, especially for production workloads during upgrades or incidents.

💬 Have you tried this setup? Drop your experience or questions in the comments!

Top comments (0)