Port reference
Port 5985 (TCP) – WinRM (HTTP)
Windows Remote Management over HTTP — PowerShell Remoting and remote administration of Windows hosts.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Cleartext
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Open on servers where WinRM/PowerShell Remoting is enabled (default on Windows Server). Carries SOAP over HTTP; message body is encrypted when authenticated.
What is port 5985 used for?
Port 5985 is WinRM (Windows Remote Management) over HTTP, Microsoft's transport for managing Windows machines remotely. It is what PowerShell Remoting uses behind commands like Enter-PSSession and Invoke-Command, and tools such as Ansible (with the WinRM connector) also rely on it to run commands and apply configuration. It is enabled by default on Windows Server and widely used across Active Directory environments.
When would you open it?
Open or forward port 5985 only on Windows machines you actively administer remotely, for example servers managed through PowerShell Remoting or automated with Ansible. It is most useful inside a trusted internal or management network. If you do not run remote Windows administration, leave it closed.
Is it safe to open?
It is reasonably safe on a trusted internal network, but since 5985 is plain HTTP the safest approach is to prefer WinRM over HTTPS (port 5986) and limit access to known admin hosts. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5985
nmap -p 5985 <target>netstat -ano | findstr :5985
Test-NetConnection <host> -Port 5985lsof -i :5985
nmap -p 5985 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5985 to your device's local IP, internal port 5985, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5985/tcpsudo firewall-cmd --permanent --add-port=5985/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5985 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5985" -Direction Inbound -Protocol TCP -LocalPort 5985 -Action AllowSecurity & risks
Use a secure alternative
This is a legacy or cleartext protocol. Prefer the encrypted equivalent:
Common attacks
- Evil-WinRM lateral movement with creds or hashes
- Pass-the-hash authentication over WinRM
- Credential brute force / password spraying
- Remote command execution after compromise
Hardening
- Prefer WinRM over HTTPS (5986) with valid certificates
- Restrict WinRM to trusted admin/jump hosts via firewall
- Disable Basic auth; require Kerberos/Negotiate
- Limit Remote Management Users and use JEA where possible
- Enforce MFA-backed privileged accounts and strong passwords
How to block this port
sudo ufw deny 5985/tcpsudo firewall-cmd --permanent --remove-port=5985/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5985 -j DROPNew-NetFirewallRule -DisplayName "Block 5985" -Direction Inbound -Protocol TCP -LocalPort 5985 -Action Blocknmap snippet
nmap -p5985 --script http-title,http-auth <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What is port 5985 used for?
- Port 5985 is WinRM over HTTP — the transport for PowerShell Remoting and remote Windows administration via WS-Management/SOAP.
- Is WinRM on port 5985 encrypted?
- The transport is HTTP, but with Kerberos/Negotiate the message payload is encrypted. Basic auth over plain 5985 is not — use HTTPS on 5986 for full transport encryption.