Port 5985 — TCP
Remote Windows administration through WinRM over HTTP.
What is port 5985 used for?
Default TCP port used by WinRM for WS-Management sessions over HTTP.
Transport protocol
TCP
Role and operation
The client opens an HTTP connection to the WinRM listener and WS-Management carries commands and responses. With integrated authentication methods such as Kerberos/Negotiate, message content can receive protocol-level protection; WinRM HTTPS on port 5986 adds TLS to the transport.
Security precautions
Restrict 5985 to trusted management networks and hosts. Avoid weak authentication methods and prefer WinRM HTTPS on 5986 when TLS is required or traffic crosses a less trusted network.
Should this port be opened in the firewall?
Allow TCP 5985 only from required administration workstations, servers, or management subnets. Do not expose it directly to the Internet.
How to verify this port
Test-NetConnection SERVER -Port 5985 checks TCP reachability. Complete the test with Test-WSMan or a PowerShell remoting session to validate the WinRM listener, authentication, and authorization.
Port/service mappings are common conventions. An application can be configured to use a different port.