PORTEncrypted (Kerberos or TLS)IANA assigned
Ports 5985 and 5986WinRM (Windows Remote Management)
Port 5985 is the HTTP listener and 5986 the HTTPS listener for Windows Remote Management (WinRM), the service behind PowerShell Remoting, Enter-PSSession and many management tools. On domain-joined machines 5985 is encrypted at the message level by Kerberos; outside a domain, 5986 with a certificate is the safe choice.
What ports 5985 and 5986 are used for
WinRM is Microsoft's implementation of WS-Management, a SOAP-over-HTTP protocol for remote administration. PowerShell Remoting rides on it, so these ports carry:
Enter-PSSessionandInvoke-Commandsessions.- Configuration management: Ansible's WinRM connection plugin, DSC, Windows Admin Center.
- Event forwarding, some monitoring agents and Hyper-V management traffic.
Before Vista, WinRM used ports 80 and 443; the move to 5985/5986 avoided collisions with web servers.
| Port | Transport | When to use |
|---|---|---|
| 5985 | HTTP | Domain-joined machines authenticating with Kerberos; the payload is encrypted |
| 5986 | HTTPS | Workgroup machines, cloud instances, any case where a certificate can be provisioned |
Security considerations
- Kerberos or certificates, not Basic auth. Basic authentication sends credentials with only base64 encoding; WinRM blocks it over HTTP by default. Keep it that way.
- Restrict the listener's source. WinRM firewall rules can be scoped to management subnets;
Enable-PSRemotinglimits the Public profile to the local subnet for good reason. - Just Enough Administration (JEA) endpoints constrain what a remote session can run. Use them for help-desk roles.
- Log it. PowerShell script block logging and WinRM operational logs record remote activity.
Checking and enabling
Test-WSMan -ComputerName server01
Get-Service WinRM
winrm enumerate winrm/config/listenerTest-WSMan returns the remote WinRM version when the listener answers. The last command lists configured listeners with their transport and port.
How to check port 5985
Is something listening locally? On Windows, open Command Prompt and run:
netstat -ano | findstr :5985A line in the LISTENING state means a local program has bound port 5985; the last column is its process ID (PID). Match the PID in Task Manager (Details tab) or with tasklist /fi "PID eq <pid>". On Linux or macOS the equivalent is ss -tulnp | grep :5985 or lsof -i :5985.
Can you reach it on a remote host? PowerShell's built-in connection test attempts a TCP handshake:
Test-NetConnection server01 -Port 5985TcpTestSucceeded : True means the remote system accepted a TCP connection on port 5985. False means the port is closed, filtered by a firewall, or the host is unreachable; the output's ping result helps tell those apart.
See the netstat and Test-NetConnection records for the full option sets.
Firewall considerations
The predefined "Windows Remote Management (HTTP-In)" rule covers 5985; a separate rule is needed for 5986. Scope both to the management network and the Domain or Private profile. Do not expose either port to the internet.
On Windows, inbound rules live in Windows Defender Firewall with Advanced Security (wf.msc). A rule allowing port 5985 only takes effect on the profile (Domain, Private, Public) it is assigned to. The command-line equivalent is netsh advfirewall firewall add rule; see the netsh record.
Frequently asked questions
Is port 5985 unencrypted?
The transport is HTTP, but WinRM encrypts the message payload when authenticating with Kerberos or NTLM, which is the default inside a domain. With Basic authentication over 5985 there is no encryption, and WinRM refuses that combination unless AllowUnencrypted is set. Outside a domain use 5986.
How do I enable WinRM?
Run Enable-PSRemoting -Force in an elevated PowerShell. It starts the service, creates an HTTP listener on 5985 and adds firewall rules for the Domain and Private profiles.
Why do I see port 47001?
WinRM also listens on TCP 47001 for the Windows Remote Management service's own use. It is separate from the client-facing 5985/5986 listeners.