Port 5986: WinRM (HTTPS)

What uses port 5986

WinRM over HTTPS needs a certificate on the Windows host and an HTTPS listener (winrm quickconfig -transport:https). Use it when managing machines outside a domain, for example cloud VMs from Ansible, so credentials and commands are protected by TLS.

Should port 5986 be open to the internet?

Restrict access. Only open this port to known networks or users, for example your office IP, a VPN or behind authentication.

Check what is listening on port 5986

sudo ss -ltnp 'sport = :5986'

sudo lsof -nP -iTCP:5986 -sTCP:LISTEN

Get-NetTCPConnection -LocalPort 5986 -State Listen
netstat -ano | findstr :5986

No output means nothing is listening. If a service should be, check that it is running and which address it binds to: 127.0.0.1 only accepts local connections, 0.0.0.0 or :: accepts them on every interface.

Fix “address already in use” on port 5986

Another process already holds the port. Find it with the commands above, then stop that service properly, or end the process:

sudo kill $(sudo lsof -t -iTCP:5986 -sTCP:LISTEN)

Stop-Process -Id (Get-NetTCPConnection -LocalPort 5986 -State Listen).OwningProcess

Allow port 5986 from trusted networks only

The examples allow 5986 only from 10.0.0.0/8; replace it with your own private network, office IP or VPN range.

sudo ufw allow from 10.0.0.0/8 to any port 5986 proto tcp
# Close it again:
sudo ufw delete allow from 10.0.0.0/8 to any port 5986 proto tcp

sudo firewall-cmd --permanent --add-rich-rule='rule family="ipv4" source address="10.0.0.0/8" port port="5986" protocol="tcp" accept'
sudo firewall-cmd --reload

New-NetFirewallRule -DisplayName "WinRM (HTTPS) 5986/TCP" -Direction Inbound -Protocol TCP -LocalPort 5986 -Action Allow -RemoteAddress 10.0.0.0/8

On AWS, Google Cloud and Azure, also allow the port in the security group or network firewall rules; host firewalls and cloud firewalls are separate.

Test port 5986 from another machine

nc -zv example.com 5986

Test-NetConnection example.com -Port 5986

Related ports

• Port 5985 (WinRM (HTTP)): used by Windows Remote Management over HTTP, including PowerShell remoting.
• Port 3389 (RDP): used by RDP, Microsoft’s Remote Desktop Protocol.
• Port 22 (SSH): used by SSH for secure remote logins, SFTP, SCP and Git over SSH.

More remote access ports

23 (Telnet) , 1194 (OpenVPN) , 2222 (SSH (alternate)) , 5900 (VNC) , 51820 (WireGuard) . See all ports in the port lookup.

Sources

• IANA port registry: 5986

Spotted a mistake? Email hello@devtoolsmith.com and we’ll fix it.

Frequently asked questions