Server 2022 RDP stopped working Terminal Service is running but does not listen on 3389

Question

According to users RDP stopped working 1-23-2026

Setting are for port 3389 have tried to rebuild the certificate, the RDS listener

installed RDS session host, no change then uninstalled

Have tried many things Terminal service starts without issue but never listens on 3389

3389 is not in use for anything else

saw on 1-20-2026 KB5073457 was installed uninstalled it also still no good

has anyone see this before

Answer 1

Hello Myler, Jim,

The behavior you describe thatTerminal Services starting but the system not listening on TCP 3389 indicates that the Remote Desktop Services stack is failing to bind the listener. Since you already confirmed that port 3389 is not in use and the RDS listener was rebuilt without success, the issue is not a simple port conflict. The timing with KB5073457 suggests a regression introduced by that update, but since uninstalling it did not restore functionality, the underlying configuration may have been altered during the patch cycle.

The first place to check is the listener configuration in the registry. Navigate to:

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp

Confirm that the PortNumber value is set to 3389 (DWORD, decimal). Also check that the SecurityLayer and UserAuthentication values are consistent with your environment. If these values are corrupted or missing, the listener will not bind.

Next, verify the binding at the OS level. Run:

qwinsta

and

netstat -ano | findstr 3389

If qwinsta shows no RDP-Tcp listener and netstat shows nothing on 3389, the service is not binding. In that case, check the system log for Event ID 101, 105, or 56 under TerminalServices-RemoteConnectionManager. These events usually indicate certificate binding failures or policy restrictions.

Since you rebuilt the certificate, confirm that the RDP service is actually pointing to a valid certificate. Open Group Policy Editor and check under Computer Configuration > Administrative Templates > Windows Components > Remote Desktop Services > Remote Desktop Session Host > Security. The setting “Select RDP transport protocols” should be set to “Use both TCP and UDP” or at least TCP. If it is set incorrectly, the listener will not start.

Another common cause after updates is that the Remote Desktop Services role is partially broken. Run:

sc query termservice

to confirm the service is running. If it is, but no listener is created, remove the RDS role completely, reboot, and reinstall it. Do not just uninstall/reinstall the Session Host component; ensure the base RDS role is clean.

Finally, check whether TLS enforcement is blocking the listener. If the update changed the minimum TLS version, and your certificate or configuration does not meet the requirement, the listener will silently fail. You can test by setting SecurityLayer to 0 (RDP Security) in the registry key above, restarting the service, and seeing if the listener binds. If it does, the issue is with TLS/certificate negotiation.

In short, the failure is not that Terminal Services won’t start, but that the RDP listener cannot bind to 3389. The most likely causes are registry corruption in RDP-Tcp, certificate binding issues, or TLS policy changes introduced by KB5073457. Reconfirm the registry values, check the event logs, and test with SecurityLayer=0 to isolate whether it is a certificate/TLS problem.

I hope you've found something useful here. If it helps you get more insight into the issue, it's appreciated to accept the answer. Should you have more questions, feel free to leave a message. Have a nice day!

Domic Vo.

Answer 2

It seems like you're experiencing issues with the Remote Desktop Protocol (RDP) listener on your Windows Server 2022, where the Terminal Service is running but not listening on port 3389. Here are some troubleshooting steps you can follow:

1. Check the RDP Listener Port: Ensure that the RDP listener is configured to use port 3389. You can check this by using the Registry Editor:
   • Open the Registry Editor and navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp.
   • Verify that the PortNumber value is set to 3389. If it's not, change it to 3389 and restart the Remote Desktop Services service.
2. Verify the Listener Status: Use the qwinsta command to check the status of the RDP listener:
   • Open a command prompt and type qwinsta. Ensure that the session state for RDP-TCP is Listen.
3. Check for Conflicting Applications: Run the following command to see if any other application is using port 3389:

      netstat -ano | find "3389"
   

   If you find another application using this port, you may need to stop that application or change its port.
4. Firewall Settings: Ensure that the firewall is not blocking port 3389. You can test connectivity using the psping tool to see if the port is reachable.
5. Recreate the Self-Signed Certificate: If you haven't done so already, try recreating the Remote Desktop self-signed certificate by deleting the existing one in the Certificates MMC snap-in and restarting the Remote Desktop Services service.
6. Check RDS Roles: If you have installed Remote Desktop Services roles, ensure that unnecessary roles are not causing conflicts. You can remove any unnecessary roles through Server Manager.

If these steps do not resolve the issue, you may need to contact Microsoft Support for further assistance, especially since you mentioned a recent Windows update (KB5073457) that could have affected the RDP functionality.

---

References:

• General Remote Desktop connection troubleshooting
• Remote Desktop can't connect to the remote computer