Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm looking at securing a web server (Windows Server 2008). A GRC port scan recommended that I close down port 135 ( However, I've done this before with Windows Server 2003 and after doing this I wasn't able to RDP to the box.

Why is port 135 needed for RDP (port 3389) and since I don't have physical access to the box should port 135 be blocked (if so what about RDP)?


share|improve this question
up vote 3 down vote accepted

The RPC Endpoint Mapper (port 135) is definitely not required by RDP, and it is perfectly reasonable (and suggested) to block it on a firewall so non local hosts cannot attempt to enumerate and exploit services.

I only say this with certainty because I have many hosts configured like this, and actually just tested it to make sure I wasn't crazy ;-)

share|improve this answer
So you have it completely blocked and you can connect via the Internet (i.e. not local network) with RDP? Thanks. – pbz May 5 '09 at 15:38
I blocked port 135 and was able to connect afterwards... phew ;) Not sure why this didn't work with W2K3. Thanks. – pbz May 5 '09 at 15:51
yes sir. This is also how Amazon EC2 deploys their servers. – Michael Gorsuch May 5 '09 at 15:52

I think because parts of Terminal Services use it:

TCP Port 135 - RPC Terminal Services Licensing

TCP Port 135 - RPC Terminal Services Session Directory

So when you connect via 3389 - the server wants to see how your TS is licensed, etc so it uses TCP/135 to call your DC or wherever your TS Licensing is kept.

This article can help

share|improve this answer
Only used within a network for licensing. You shouldn't be licensing your servers over the the internet. – Mark May 5 '09 at 15:41
It must be something specific to Windows Server 2003, because I tried it with Server 2008 and it worked. Thanks. – pbz May 5 '09 at 15:52

Yes! Close that port!

Done it? Whew...

Don't expose that port to the outside. Not a good idea. You'll be fine with just the RDP port open. Yes, I have empirically tested this with a server running RDP. Note that there are some DoS attacks against unpatched RDP servers, so be sure to get up-to-date.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.