# WHATPORT(5986)

## NAME

port 5986 — WinRM / WS-Management over HTTPS — The TLS-wrapped WinRM listener — same remote-admin plane as 5985, with a certificate in front of it.

Protocol: TCP  
IANA registry

## DESCRIPTION

IANA registers 5986 as `wsmans`, WS-Management over TLS, and it is WinRM 2.0's default HTTPS listener port. It is created explicitly with `winrm quickconfig -transport:https`, which requires a server certificate whose CN matches the host, so it is common in workgroup and cross-domain scenarios where Kerberos mutual authentication is not available. Because the transport itself is authenticated and encrypted, this is the listener that Ansible's `winrm` connection plugin and most cloud Windows images prefer.

## EXPOSURE

**Do not expose.** TLS fixes the wire, not the blast radius: a valid credential here is a shell as that user. Restrict source addresses via IPv4Filter/IPv6Filter and the host firewall rather than relying on the certificate alone.

## CHECK

```sh
openssl s_client -connect TARGET:5986 -servername TARGET </dev/null 2>/dev/null | openssl x509 -noout -subject -dates
```

## SEE ALSO

- docs — [Microsoft — Installation and configuration for Windows Remote Management](https://learn.microsoft.com/en-us/windows/win32/winrm/installation-and-configuration-for-windows-remote-management) (learn.microsoft.com)
- spec — [DMTF DSP0226 — Web Services for Management (WS-Management)](https://www.dmtf.org/sites/default/files/standards/documents/DSP0226_1.2.0.pdf) (dmtf.org)
- iana — [IANA port registry — 5986 (wsmans)](https://www.iana.org/assignments/service-names-port-numbers/service-names-port-numbers.xhtml?search=5986) (iana.org)

---

HTML: <https://whatport.net/5986/> · JSON: <https://whatport.net/5986.json> · full dataset: <https://whatport.net/ports.json>