Remote Desktop — a full interactive Windows login, and one of the most attacked ports on the internet.
IANA calls it ms-wbt-server; everyone else calls it RDP. Windows Remote Desktop Services listens on TCP 3389 (with an optional UDP 3389 transport for graphics acceleration), speaking MS-RDPBCGR: an X.224 connection request, then a TLS or CredSSP/NLA handshake, then the graphics and input channels. It is enabled on countless Windows Server instances, Azure and EC2 VMs, and desktop machines that someone needed to reach from home. The listening port is a registry setting, so a host with RDP moved to another port often still answers the same handshake there.
Do not expose
Internet-facing RDP is the dominant ransomware entry vector — credential stuffing plus pre-auth bugs like BlueKeep (CVE-2019-0708). Put it behind a VPN or an RD Gateway, require NLA, and never publish 3389 directly.
$ nmap -Pn -p 3389 --script rdp-ntlm-info TARGETSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.