TCP Port 5986 – Windows Remote Management (WinRM HTTPS)

Port 5986 is Windows Remote Management over HTTPS, the TLS protected transport for PowerShell Remoting and WS-Management traffic. IANA registers it as wsmans. It wraps the same management capability as port 5985 in certificate based transport security.

About TCP Port 5986

The Internet Assigned Numbers Authority (IANA) registers port 5986 for wsmans. The IANA description reads: ‘WBEM WS-Management HTTP over TLS/SSL’.

Security Considerations

The TLS wrapper protects credentials and session content in transit, but the capability behind the port is unchanged: valid credentials mean remote command execution. Attackers with stolen accounts move laterally over WinRM on either transport. Restrict the port to management networks, require strong authentication, and watch for WinRM sessions from unexpected sources. The HTTPS variant is safer than 5985 only in transit; it is still a remote administration door and does not belong on the open internet.

Data Sources

This information is compiled from: IANA Service Name and Transport Protocol Port Number Registry.