Port 5985: WinRM (HTTP)

What uses port 5985

PowerShell remoting (Enter-PSSession), Ansible on Windows and many management tools use WinRM. Port 5985 is HTTP, but the payload is still encrypted with Kerberos or NTLM inside a domain; 5986 uses HTTPS and is needed with basic authentication or outside a domain.

Should port 5985 be open to the internet?

Keep private. Never expose this port to the internet. Keep it on localhost, a private network or behind a VPN or SSH tunnel.

Check what is listening on port 5985

sudo ss -ltnp 'sport = :5985'

sudo lsof -nP -iTCP:5985 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 5985 -State Listen
netstat -ano | findstr :5985

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 5985

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:5985 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 5985 -State Listen).OwningProcess

Allow port 5985 from trusted networks only

The examples allow 5985 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 5985 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5985 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5985" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "WinRM (HTTP) 5985/TCP" -Direction Inbound -Protocol TCP -LocalPort 5985 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 5985 from another machine

nc -zv example.com 5985

Test-NetConnection example.com -Port 5985

Related ports

• Port 5986 (WinRM (HTTPS)): used by Windows Remote Management over HTTPS.
• Port 3389 (RDP): used by RDP, Microsoft’s Remote Desktop Protocol.
• Port 135 (Microsoft RPC): the Microsoft RPC endpoint mapper, used by many Windows services.
• Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.

More remote access ports

23 (Telnet) , 1194 (OpenVPN) , 2222 (SSH (alternate)) , 5900 (VNC) , 51820 (WireGuard) . See all ports in the port lookup.

Sources

• IANA port registry: 5985

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions