Remote Desktop is not listening on TCP port 3389

Troubleshooting guideSources checked: 2026-09-05FaultNote editorial team

What to do first

Remote Desktop is not listening on TCP port 3389. Remote Desktop may be disabled, TermService stopped, built-in inbound rules disabled, or an upstream network may block traffic. Record the current state before changing it, use only the supported Windows path described below, and verify the same operation again after any required restart.

This is a general troubleshooting guide, not an announcement of a current outage.

Affected products and symptoms

Product: Remote Desktop
Versions and conditions: Windows 11 (confirm the edition and hardware requirements for the feature)
Error codes and identifiers: 0x204

Symptoms

Remote Desktop is not listening on TCP port 3389.
The same condition can persist after a retry or restart.

Causes and conditions

Remote Desktop may be disabled, TermService stopped, built-in inbound rules disabled, or an upstream network may block traffic.

Before you start

Save open documents and allow time for a Windows restart if required.
Run administrative actions only on a personally managed PC or with administrator approval.
Save the diagnostic command output so the before and after states can be compared.

Precautions

Do not bulk-delete registry entries, system folders, credentials, or storage metadata.
Do not run unofficial scripts or unknown drivers with administrator rights.

Remote Desktop troubleshooting sequence: Check whether the destination supports RDP hosting; Check the state with Get-NetTCPConnection; Repair through the supported path; Inspect the built-in rules on the destination; Verify under the same conditions — Procedure overview created by FaultNote. Read the precautions and full instructions before changing settings. Read the full steps

Step-by-step instructions

01
Check whether the destination supports RDP hosting
#
Keep the client and destination separate during these checks. Windows Home cannot act as a standard Remote Desktop host. First confirm that the destination is awake, the required VPN is connected, and the administrator has not configured a port other than 3389.
02
Check the state with Get-NetTCPConnection
#
On the destination PC, check whether TCP 3389 is listening; do not run the listener check only on the client.
Command or path
```
Get-NetTCPConnection -LocalPort 3389 -State Listen
```
03
Repair through the supported path
#
On a supported Windows edition, open Settings > System > Remote Desktop and enable Remote Desktop. Confirm the built-in Remote Desktop firewall rule group is enabled for the active network profile.
04
Inspect the built-in rules on the destination
#
On the destination, open Windows Defender Firewall with Advanced Security and inspect the Remote Desktop inbound rules. Display names vary with the Windows language, so a missing English DisplayGroup match does not prove the rule is absent. Keep the firewall enabled and have the administrator check the active profile and allowed sources.
05
Verify under the same conditions
#
Replace HOST_NAME with the actual value for your system before using this example.
Run Test-NetConnection <host> -Port 3389 and repeat the original operation once under the same conditions. If it succeeds, verify again after a restart and record the setting that changed.
Check that no new critical event with the same timestamp and component appears in Event Viewer.
Command or path
```
Test-NetConnection HOST_NAME -Port 3389
```

Check the result

The feature starts, connects, or completes without the original error.
The verification command reports the expected enabled, healthy, or connected state.
The result remains correct after a Windows restart and no new matching critical event appears.

If the problem continues

If the same code persists, provide the full message, Windows build, command output, and occurrence time to the PC administrator or Microsoft Support.
If hardware requirements, organization policy, or server settings are responsible, ask the owner to make the change instead of bypassing it on the client.

Scope of this guide

Troubleshooting guide — Restore the feature so it starts, connects, or completes normally and passes the same verification after a Windows restart.

Frequently asked questions

Does a closed port 3389 prove the firewall is blocking it?

No. The service or listener may be absent. Check Remote Desktop, TermService, the listener, then built-in firewall rules on the destination.

Should I expose TCP 3389 directly to the internet?

Use a managed VPN or RD Gateway and coordinate the design with the network administrator.

Official sources and dates

General Remote Desktop connection troubleshooting ↗

Source publication or resolution date: Not specified. Sources checked: 2026-09-05. The check date is not the date the problem first occurred. Interface labels can vary between versions and display languages.

Related troubleshooting guides

← Search English guides