Port reference
Port 5986 (TCP) – WinRM over HTTPS
TLS-encrypted Windows Remote Management (WS-Management) endpoint, the secure counterpart of plaintext WinRM on 5985.
Quick facts
- Transport
- tcp
- Category
- Registered
- TLS
- Encrypted
- Risk level
- High
Frequently targeted — restrict exposure and harden it.
Default state
Not listening unless WinRM is configured for HTTPS. When enabled it requires valid Windows credentials; the channel is encrypted, unlike 5985 over HTTP.
What is port 5986 used for?
Port 5986 is WinRM over HTTPS, the TLS-encrypted form of Windows Remote Management. It is the secure counterpart of plaintext WinRM on port 5985 and serves the same purpose: running PowerShell and management commands on Windows machines remotely. PowerShell Remoting and automation tools like Ansible can be pointed at 5986 so that credentials and session data travel over an encrypted channel.
When would you open it?
Open or forward port 5986 on Windows machines you manage remotely when you want encrypted remote administration, which is the recommended choice over the plain HTTP port. It is well suited to management networks and to any host reachable beyond a fully trusted LAN. If you do not administer Windows remotely, leave it closed.
Is it safe to open?
It is the safer of the two WinRM ports because the channel is encrypted with TLS, but valid credentials still grant full remote access, so use strong accounts and restrict it to known admin hosts. See the security notes below.
How to check if this port is open
ss -tulpn | grep :5986
nmap -p 5986 <target>netstat -ano | findstr :5986
Test-NetConnection <host> -Port 5986lsof -i :5986
nmap -p 5986 <target>How to open this port on your router
To reach this service from outside your network, forward the port on your router:
- Open your router's admin page (usually http://192.168.1.1 or http://192.168.0.1) and sign in.
- Find the "Port Forwarding" section — it may be called NAT, Virtual Server, or Applications & Gaming.
- Add a rule forwarding external port 5986 to your device's local IP, internal port 5986, protocol TCP.
- Save and reboot the router if prompted, then test the port from outside your network.
Only forward ports you understand — it exposes that device to the public internet. For remote admin access, a VPN is safer than forwarding the port.
Allow this port through the firewall
sudo ufw allow 5986/tcpsudo firewall-cmd --permanent --add-port=5986/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5986 -j ACCEPTNew-NetFirewallRule -DisplayName "Allow 5986" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action AllowSecurity & risks
Common attacks
- Credential-based lateral movement via Evil-WinRM and similar tools
- Password spraying and brute-force of Windows accounts
- Pass-the-hash / NTLM relay to obtain a remote PowerShell session
- Abuse of over-privileged service accounts for remote command execution
Hardening
- Prefer 5986 (HTTPS) over 5985 (HTTP) and disable plaintext WinRM
- Restrict WinRM to management networks/jump hosts via firewall
- Require strong, unique credentials and enforce MFA where possible
- Limit Remote Management privileges; avoid broad local-admin reuse
- Use valid TLS certificates and monitor for anomalous WinRM logons
How to block this port
sudo ufw deny 5986/tcpsudo firewall-cmd --permanent --remove-port=5986/tcp
sudo firewall-cmd --reloadsudo iptables -A INPUT -p tcp --dport 5986 -j DROPNew-NetFirewallRule -DisplayName "Block 5986" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Blocknmap snippet
nmap -p5986 --script ssl-cert <target>Replace <target> with the host or range you're authorized to scan.
Related ports
Frequently asked questions
- What's the difference between port 5985 and 5986?
- Both serve WinRM (WS-Management). 5985 carries it over plain HTTP; 5986 wraps it in HTTPS/TLS. Always prefer 5986 so credentials and session data are encrypted in transit.
- Why do attackers target WinRM on 5986?
- WinRM grants a remote PowerShell session, ideal for lateral movement. With stolen or sprayed credentials, tools like Evil-WinRM give a full interactive shell on the host — even though the 5986 channel itself is encrypted.