Attackers love non-standard ports. If you see RDP on 0x904, ask why —and verify the owner.
This is the most common administrative occurrence of this code. It typically appears in Windows Event Logs (specifically under ) when a user attempts to redirect a specific resource (like a USB drive, printer, or smart card) into an RDP session, but the broker rejects the connection. 0x904 rdp