Ports 5985 and 5986 · TCP

Ports 5985 and 5986: WinRM (PowerShell remoting)

Windows Remote Management, the transport for PowerShell remoting. 5986 is the HTTPS version.

Protocol
TCP
On Windows
System (PID 4, Windows Remote Management via http.sys)
Risk if open to the internet
High

Seeing it on your PC

Not on by default on Windows 10 and 11. A listener here means someone ran Enable-PSRemoting or a management tool turned it on.

Should you block it?

Normal in a managed organisation. On a home PC, find out why it is on, and keep it off the internet in every case.

Check it on your PC

Run this in PowerShell to see what is using port 5985 right now, and which program owns it:

Get-NetTCPConnection -LocalPort 5985 -ErrorAction SilentlyContinue | Select-Object LocalAddress,LocalPort,RemoteAddress,RemotePort,State,@{n='Process';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName}}

No output means nothing is using the port at the moment. For every connection at once, paste netstat -ano into the netstat explainer.

Block it in Windows Firewall

In PowerShell run as administrator, this stops other computers from connecting to this port on your PC. It does not stop your own programs connecting out.

New-NetFirewallRule -DisplayName "Block inbound TCP 5985,5986" -Direction Inbound -Protocol TCP -LocalPort 5985,5986 -Action Block

Undo it with Remove-NetFirewallRule -DisplayName "Block inbound …", using the same name. If you depend on the service on your local network, this rule stops that too.