The TLS-wrapped WinRM listener — same remote-admin plane as 5985, with a certificate in front of it.
IANA registers 5986 as wsmans, WS-Management over TLS, and it is WinRM 2.0's default HTTPS listener port. It is created explicitly with winrm quickconfig -transport:https, which requires a server certificate whose CN matches the host, so it is common in workgroup and cross-domain scenarios where Kerberos mutual authentication is not available. Because the transport itself is authenticated and encrypted, this is the listener that Ansible's winrm connection plugin and most cloud Windows images prefer.
Do not expose
TLS fixes the wire, not the blast radius: a valid credential here is a shell as that user. Restrict source addresses via IPv4Filter/IPv6Filter and the host firewall rather than relying on the certificate alone.
$ openssl s_client -connect TARGET:5986 -servername TARGET </dev/null 2>/dev/null | openssl x509 -noout -subject -datesSeen this on your network? Beige Box scans your Wi-Fi and shows every open port on every device — and its Ports tool links straight back here.
Get Beige Box →also available as JSON · Markdown
Corrections or a missing port? Reply @rimrocksystems.