Port 5986 (WinRM (HTTPS))

WinRM over HTTPS.

Registered (user) port, 1024-49151 TCP Windows networking Expose only to trusted sources

What port 5986 is used for

WinRM over HTTPS.

Expose only to trusted sources. Prefer it over 5985 between networks, but still allowlist management sources.

Service nameProtoDescriptionAssigneeReference

wsmans TCP WBEM WS-Management HTTP over TLS/SSL Jim Davis -

wsmans UDP WBEM WS-Management HTTP over TLS/SSL Jim Davis -

Registry dates for this port: registered 2006-11.

Linux: is anything listening on TCP 5986?

sudo ss -tlnp 'sport = :5986'

Linux / macOS: which process owns the port

sudo lsof -nP -i :5986

Older Linux / BSD (net-tools)

sudo netstat -tlnp | grep ':5986 '

Windows (Command Prompt)

netstat -ano | findstr :5986

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 5986 -State Listen | Select LocalAddress,OwningProcess

From another machine

nc -vz -w 5 HOST 5986

From Windows

Test-NetConnection HOST -Port 5986

Replace 203.0.113.10 with the address or network you trust. With ufw, make sure the default incoming policy is deny.

ufw (one trusted source)

sudo ufw allow from 203.0.113.10 to any port 5986 proto tcp

iptables

sudo iptables -A INPUT -p tcp --dport 5986 -s 203.0.113.10 -j ACCEPT
sudo iptables -A INPUT -p tcp --dport 5986 -j DROP

nftables

sudo nft add rule inet filter input ip saddr 203.0.113.10 tcp dport 5986 accept
sudo nft add rule inet filter input tcp dport 5986 drop

Windows Firewall

New-NetFirewallRule -DisplayName 'TCP 5986 trusted' -Direction Inbound -Protocol TCP -LocalPort 5986 -RemoteAddress 203.0.113.10 -Action Allow

All port numbers · Open port checker
Assignment data: IANA port number registry (public domain), retrieved 2026-11-10.