{
  "port": 5986,
  "protocol": "tcp",
  "service": "WinRM / WS-Management over HTTPS",
  "oneLiner": "The TLS-wrapped WinRM listener — same remote-admin plane as 5985, with a certificate in front of it.",
  "whatItIs": "IANA registers 5986 as `wsmans`, WS-Management over TLS, and it is WinRM 2.0's default HTTPS listener port. It is created explicitly with `winrm quickconfig -transport:https`, which requires a server certificate whose CN matches the host, so it is common in workgroup and cross-domain scenarios where Kerberos mutual authentication is not available. Because the transport itself is authenticated and encrypted, this is the listener that Ansible's `winrm` connection plugin and most cloud Windows images prefer.",
  "exposure": {
    "verdict": "never",
    "note": "TLS fixes the wire, not the blast radius: a valid credential here is a shell as that user. Restrict source addresses via IPv4Filter/IPv6Filter and the host firewall rather than relying on the certificate alone."
  },
  "checkCommand": "openssl s_client -connect TARGET:5986 -servername TARGET </dev/null 2>/dev/null | openssl x509 -noout -subject -dates",
  "links": [
    {
      "title": "Microsoft — Installation and configuration for Windows Remote Management",
      "url": "https://learn.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management",
      "kind": "official-docs"
    },
    {
      "title": "DMTF DSP0226 — Web Services for Management (WS-Management)",
      "url": "https://www.dmtf.org/sites/default/files/standards/documents/DSP0226_1.2.0.pdf",
      "kind": "spec"
    },
    {
      "title": "IANA port registry — 5986 (wsmans)",
      "url": "https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5986",
      "kind": "iana"
    }
  ]
}