change_rdp_port.ps1

# change_rdp_port.ps1
# Script to change the RDP port, enable RDP if disabled, and configure Windows Firewall
# Author: Hosteons (https://hosteons.com)
# License: MIT

Write-Host "=== RDP Port Changer Script by Hosteons ===`n"

# Ensure the script is run as Administrator
If (-NOT ([Security.Principal.WindowsPrincipal][Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole(`
    [Security.Principal.WindowsBuiltInRole] "Administrator"))
{
    Write-Warning "Please run this script as Administrator."
    Exit
}

# Prompt for new RDP port
do {
    $newPort = Read-Host "Enter new RDP port (between 1025 and 65535)"
} while (-not ($newPort -match '^\d+$' -and [int]$newPort -ge 1025 -and [int]$newPort -le 65535))

$newPort = [int]$newPort

# Define Registry path for RDP configuration
$rdpRegPath = "HKLM:\System\CurrentControlSet\Control\Terminal Server\WinStations\RDP-Tcp"

# Change the port number in the registry
Set-ItemProperty -Path $rdpRegPath -Name "PortNumber" -Value $newPort
Write-Host "RDP port changed to $newPort."

# Enable RDP if currently disabled
$rdpStatus = Get-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections"
if ($rdpStatus.fDenyTSConnections -ne 0) {
    Set-ItemProperty -Path "HKLM:\System\CurrentControlSet\Control\Terminal Server" -Name "fDenyTSConnections" -Value 0
    Write-Host "RDP has been enabled."
}

# Add a new firewall rule for the new RDP port
New-NetFirewallRule -DisplayName "Allow RDP on port $newPort" -Direction Inbound -LocalPort $newPort -Protocol TCP -Action Allow -Profile Any -ErrorAction SilentlyContinue
Write-Host "Firewall rule added for port $newPort."

# Restart Remote Desktop Services
Restart-Service -Name TermService -Force
Write-Host "`nRDP service restarted. You can now connect using port $newPort."

# Final safety notice
Write-Host "`nImportant: Ensure you have access to your system via console, VNC, or IPMI in case something goes wrong."