Port 5985 (WinRM (HTTP))

Windows Remote Management / PowerShell Remoting over HTTP (message-level encrypted with Kerberos or NTLM). Ansible uses it for Windows hosts.

Registered (user) port, 1024-49151 TCP Windows networking Do not expose to the internet

What port 5985 is used for

Windows Remote Management / PowerShell Remoting over HTTP (message-level encrypted with Kerberos or NTLM). Ansible uses it for Windows hosts.

Security: should port 5985 be open?

Do not expose to the internet. Never expose: it gives remote command execution to anyone with valid credentials and is a favourite lateral-movement path. Limit to management hosts.

IANA assignment

Service nameProtoDescriptionAssigneeReference

wsman TCP WBEM WS-Management HTTP Jim Davis -

wsman UDP WBEM WS-Management HTTP Jim Davis -

Registry dates for this port: registered 2006-11.

Check what is listening on port 5985

Linux: is anything listening on TCP 5985?

sudo ss -tlnp 'sport = :5985'

Linux / macOS: which process owns the port

sudo lsof -nP -i :5985

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':5985 '

Windows (Command Prompt)

netstat -ano | findstr :5985

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5985 -State Listen | Select LocalAddress,OwningProcess

Test it from outside

From another machine

nc -vz -w 5 HOST 5985

From Windows

Test-NetConnection HOST -Port 5985

Block port 5985 in the firewall

ufw

sudo ufw deny 5985/tcp

iptables

sudo iptables -A INPUT -p tcp --dport 5985 -j DROP

nftables

sudo nft add rule inet filter input tcp dport 5985 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'Block TCP 5985' -Direction Inbound -Protocol TCP -LocalPort 5985 -Action Block

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.