// REFERENCE · PORT 5985 · TCP

Port 5985: WinRM HTTP

Port 5985 is Windows Remote Management over HTTP, used for PowerShell remoting.

AT A GLANCE
PORT
5985 / TCP
SERVICE
WinRM HTTP
ALSO CALLED
winrm, wsman, powershell remoting
IF EXPOSED
HIGH RISK IF EXPOSED

What runs on port 5985

WinRM listens on TCP 5985 (HTTP) and 5986 (HTTPS) and lets administrators run PowerShell commands on remote Windows machines. It is enabled by default on Windows Server and off on client Windows.

On a home network

Home PCs do not normally listen on 5985 unless someone ran Enable-PSRemoting. Small offices with a Windows server will have it on that server.

If port 5985 is reachable from the internet

WinRM on the internet invites password guessing that, if it succeeds, gives an attacker a full remote shell. It is a favourite tool for attackers moving between machines inside networks. Keep it internal.

How to check whether it is open on your network

Check port forwarding rules for 5985 and 5986. On Windows, running winrm enumerate winrm/config/listener in an administrator prompt shows whether it is listening.

// RELATED PORTS
3389RDPTCPHIGH RISK IF EXPOSED135MS RPCTCPHIGH RISK IF EXPOSED445SMBTCPHIGH RISK IF EXPOSED
ON YOUR PHONE · EXPOSURE CHECK

To find out whether port 5985 is open on something in your home, and whether the internet can reach it, the app scans your Wi-Fi from your phone and checks your public address from the outside. It says what it checked and what it could not. Get RECON for iPhone — one-time purchase, no account, nothing leaves the device.

ALL PORTSPORT LOOKUPSUBNET CALCULATOR
// OTHER TOOLS
Subnet Calculator
IPV4 · IPV6 · CIDR
MAC Vendor Lookup
OUI · MA-L · MA-M · MA-S
Certificate & CSR Decoder
X.509 · PKCS#10 · PEM · DER
DNS Leak Test
VPN · RESOLVER · PRIVACY
DNS Benchmark
CLOUDFLARE · GOOGLE · QUAD9 · 8 RESOLVERS
Port Lookup
TCP · UDP · WHAT IS PORT…
HAR Analyzer
HTTP ARCHIVE
What Is My IP
PUBLIC IP · FINGERPRINT