Windows 11 Pro — RDP not listening on port 3389

Yes. Since PortNumber is 3389 but netstat shows no listener, the next checks are the RDP-TCP listener state, required services, registry values tied to the listener, and port conflicts.

1. Verify the RDP-TCP listener exists and is in Listen state. Run:

      qwinsta
   

   Expected result: a line like rdp-tcp ... Listen.
2. If rdp-tcp is missing or not Listen, check these registry values. Warning: registry changes are risky. Back up the registry first.
   • Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp
     • fEnableWinStation must be 1
   • Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server
     • fDenyTSConnections must be 0
   • If configured by policy, also check:
     • Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services
     • fDenyTSConnections must also be 0 Policy values override default values.
3. Confirm both required services are running.
   • Remote Desktop Services (TermService)
   • Remote Desktop Services UserMode Port Redirector (UmRdpService) If either service fails to start, Microsoft recommends contacting Support.
4. Check whether another process is using port 3389. Run in an elevated Command Prompt or PowerShell:

      tasklist /svc | findstr TermService
      netstat -anob | findstr 3389
   

   The PID for TermService should match the PID listening on port 3389. If it does not match, stop the process using 3389, then restart TermService.
5. Check the RDP self-signed certificate.
   • Open the Certificates MMC snap-in.
   • Manage the Computer account for the affected computer.
   • In Certificates under Remote Desktop, delete the RDP self-signed certificate.
   • Restart Remote Desktop Services.
   • Refresh the snap-in and confirm the certificate is recreated.
6. Check for unnecessary Remote Desktop Services roles. In Server Manager > Manage > Remove Roles and Features > Server Roles > Remote Desktop Services, remove unnecessary roles if present, then restart the machine.
7. If the listener still does not work, check these additional conditions.
   • Add Network Service to the local Administrators group, then restart TermService:

          Add-LocalGroupMember -Group Administrators -Member "Network Service"
     

   • In Computer\HKEY_LOCAL_MACHINE\SYSTEM\Setup, confirm both values are 0:
     • SystemSetupInProgress
     • OOBEInProgress
8. Last registry repair step if the listener is broken. Warning: this is disruptive and can prevent RDP access while the key is missing. Export Computer\HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp from a working machine with the same Windows version, back up the existing key on the affected machine, then replace it.
9. If qwinsta shows rdp-tcp is working and connectivity is otherwise good, but the issue remains, contact Microsoft Support.

• Remote Desktop can't connect to the remote computer
• Remote Desktop can't connect to the remote computer
• General Remote Desktop connection troubleshooting