# WHATPORT(5985)

## NAME

port 5985 — WinRM / WS-Management over HTTP — Windows Remote Management — the transport behind PowerShell Remoting and winrs.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA registers 5985 as `wsman`, WBEM WS-Management over HTTP, and Microsoft adopted it as WinRM's default HTTP listener from WinRM 2.0 onward (Windows 7 / Server 2008 R2), replacing the older port 80 listener. This is what `Enter-PSSession`, `Invoke-Command`, `winrs`, and most configuration-management tooling for Windows actually talk to. No listener exists until someone runs `winrm quickconfig` or enables PowerShell Remoting, so seeing it open means the host is deliberately set up for remote administration — often a domain member, a CI build agent, or an Ansible/Puppet target.

## EXPOSURE

**Do not expose.** This is a remote-code-execution plane. Even though WinRM applies message-level encryption when Negotiate/Kerberos is used, `AllowUnencrypted` and Basic auth can be switched on, and the service should be reachable only from a management network.

## CHECK

```sh
curl -s -o /dev/null -w '%{http_code}\n' -m 5 http://TARGET:5985/wsman
```

## SEE ALSO

- docs — [Microsoft — Installation and configuration for Windows Remote Management](https://learn.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management) (learn.microsoft.com)
- docs — [Microsoft — Running remote commands (PowerShell Remoting)](https://learn.microsoft.com/en-us/powershell/scripting/security/remoting/running-remote-commands) (learn.microsoft.com)
- spec — [DMTF DSP0226 — Web Services for Management (WS-Management)](https://www.dmtf.org/sites/default/files/standards/documents/DSP0226_1.2.0.pdf) (dmtf.org)
- iana — [IANA port registry — 5985 (wsman)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5985) (iana.org)

---

HTML: <https://whatport.net/5985/> · JSON: <https://whatport.net/5985.json> · full dataset: <https://whatport.net/ports.json>