The Remote Desktop you opened "just for now" is still open

It usually starts as a favour to yourself. Someone needed to reach the office PC from home for an evening — to grab a file, finish a quote, keep a job moving — so they turned on Remote Desktop (the built-in Windows feature for controlling a machine from elsewhere) and forwarded a port on the router so it would work from outside. It did the job. And then, because it was never causing any trouble, it stayed on.

Remote Desktop listens on a well-known door: port 3389. When that port is forwarded to the open internet, the office PC isn’t quietly available to you — it’s answering the entire world. In everyone’s memory it was a one-evening arrangement; on the network it’s a permanent invitation, and the box has been repeating it to anyone who knocks ever since.

This is the quiet failure: a convenience nobody remembered to undo, leaving a Windows machine’s login prompt facing the internet. It matters because exposed Remote Desktop is one of the most common ways ransomware gets into a small organisation in the first place — automated scanners find an open 3389, then hammer the login with guessed passwords until one works, usually within minutes of the port appearing.

Why it stays invisible

Nothing about the machine looks different once it’s exposed. It doesn’t slow down, it doesn’t warn you, it works exactly as it did. The person who opened the port has long since moved on to other things, and the setting sits in a router menu nobody opens from one year to the next. There’s no symptom to notice — which is exactly why it lingers.

On the other side, it could hardly be easier to find. The internet is continuously catalogued by scanning services like Shodan, which index every address answering on port 3389. An attacker doesn’t need to know your business exists; they pull the list of every open Remote Desktop in a country and start working through it. The brute-forcing is done by software, around the clock, at no cost to them — so an exposed login isn’t a small risk that might one day matter. It’s found and tested almost immediately.

Find it yourself

You can check whether you’re answering the internet in about ten minutes. Nothing to install.

1. Find the public IP address of your office or the machine in question — search “what is my IP” from that network.
2. Type internetdb.shodan.io/ followed by that address into your browser (for example internetdb.shodan.io/203.0.113.7). This free Shodan lookup lists the open ports it has already indexed at that address — you’re looking for 3389, the Remote Desktop port. (Shodan’s fuller searches at shodan.io need a free login, and its net: range filter a one-off paid membership; the free lookup answers this question on its own.)
3. On the Windows PC itself, check whether Remote Desktop is even meant to be on. Open Settings → System → Remote Desktop and see whether it’s switched on. If your work doesn’t rely on it, that’s your answer already.
4. Check the router. Log in to it and look at the port forwarding section for any rule sending port 3389 (or a custom port) to a PC on the network. That rule is the open door.

No stomach for the router menus? The quickest tell is step 3: if Remote Desktop is switched off on the PC, nothing is listening, and there is nothing to expose. Turning it off is both the check and the fix.

What you’re hoping for is a Shodan search that finds nothing on 3389 and a Remote Desktop setting that’s off. What you’re watching for is a live login prompt on that port — a machine quietly inviting the internet to guess its password.

The fix

The aim is simple: don’t let a login prompt face the open internet.

Turn it off if you don’t use it. The strongest fix costs nothing. If nobody genuinely needs Remote Desktop, switch it off in Settings → System → Remote Desktop and remove the router’s port-forwarding rule. A feature that isn’t running can’t be brute-forced.

If you do need it, don’t expose it directly. Reach the machine through a Virtual Private Network (VPN) — so you’re on the network before Remote Desktop is reachable at all — rather than forwarding port 3389 to the world. This single change takes the login prompt off the public internet while keeping the convenience that made someone open it.

Make the login worth attacking harder. For any account that can sign in remotely, use a long, unique password and turn on an extra layer — Network Level Authentication, and multi-factor authentication where your setup supports it — so a guessed password alone isn’t enough.

Look again now and then. Ports get forwarded for the next one-evening favour too. Re-running the Shodan check, or a glance at the router’s forwarding rules each quarter, turns a one-off tidy-up into a habit — which is the difference between staying shut and quietly drifting open again.

None of this needs a specialist. It needs someone to decide, once, that “just for now” had an end date — and to close the door that never got shut.