--- title: "WinRM Ports: Default Settings and Customization Guide" description: "Understand WinRM ports for HTTP and HTTPS communication and learn how to change them in this detailed guide for IT professionals." canonical: "https://adamtheautomator.com/winrm-port/" --- # WinRM Ports: Default Settings and Customization Guide > Understand WinRM ports for HTTP and HTTPS communication and learn how to change them in this detailed guide for IT professionals. Source: https://adamtheautomator.com/winrm-port/ --- ATA Learning Tap to hide [ ATA Learning ](/) * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Search for: * [](https://twitter.com/adbertram) * [](https://github.com/Adam-the-Automator) * [](https://www.linkedin.com/company/adam-the-automator-llc) * [](/feed/) ![WinRM Ports: Default Settings and Customization Guide](https://adamtheautomator.com/wp-content/uploads/2021/01/Default-WinRm-Ports-and-How-to-Change-Them.jpg) # WinRM Ports: Default Settings and Customization Guide [![](https://secure.gravatar.com/avatar/592cc421b96f8a3f79f030a608d24047fcc0ec05ba59b5b9110af4804a6774b8?s=192&d=mm&r=g)Tyler Muir](https://adamtheautomator.com/author/tyler/)27 January 20213 min. read Categories: [IT Ops](/category/it-ops/) Tags:[PowerShell](/tag/powershell/) Table of Contents * [The WinRM Listener](#h-the-winrm-listener) * [Errors Connecting to Wrong Ports](#h-errors-connecting-to-wrong-ports) * [Changing WinRM Ports](#h-changing-winrm-ports) * [Tracking Down Existing Connections](#h-tracking-down-existing-connections) * [Setting WinRM Compatibility Ports](#h-setting-winrm-compatibility-ports) * [Setting WinRM to Listen on Any Port](#h-setting-winrm-to-listen-on-any-port) * [Connecting to a Custom Port with PSRemoting](#h-connecting-to-a-custom-port-with-psremoting) WinRM and PowerShell Remoting is a crucial feature to have when managing remote Windows computers. Just like other services, WinRM listens on specific ports under specific circumstances. In this tutorial, learn those WinRM ports and even how to change them, if needed. **_Related: [PowerShell Remoting: The Ultimate Guide](https://adamtheautomator.com/psremoting/)_** ## The WinRM Listener One of the most important parts of WInRM (and the ports it runs on) is the WinRM listener. The WinRM listener is a web server at its core. It communicates with HTTP and HTTPS and back in the pre-Windows 7 days it even used to default to the same port 80 and port 443 that most web servers use. The listener runs as a service on your computer that is waiting for connections to attempt to be established, just like a normal web server. A WinRm listener can listen two different ways; HTTP or HTTPS. The WinRM port for HTTP is 5985 while the WinRm port for HTTPS is 5986, by default. * HTTP – Port 5985 * HTTPS – Port 5986 **_Related: [PowerShell Remoting: The Ultimate Guide](https://adamtheautomator.com/psremoting/)_** ## Errors Connecting to Wrong Ports And if you do not add the firewall rule when you change the port you will get the same message even when providing the port like this. ## **Changing WinRM Ports** While Microsoft recommends staying with the default listening ports for compatibility and ease of use, you can change them. This can be helpful in cases when this is a conflict with the default ports or a firewall restriction blocking the use of those ports. Maybe you have a system set up that’s configured to connect to WinRM over custom ports. When you try to connect like normal, you receive the following error message: ![Failed WinRM connection due to wrong port](https://adamtheautomator.com/wp-content/uploads/2021/01/Session_Port_Fail.png) Failed WinRM connection due to wrong port If so, it’s time to change the WinRM port on the server side! To change the WinRm ports, you’ll first need to figure out if you already have a service listening on those ports. ### Tracking Down Existing Connections The easiest way to discover what ports are in use on a Windows machine is to use the `netstat` [_tool_.](https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) Netstat checks for all active ports on your system and, if active, returns the source and destination IP and port used. To track down listening ports prior to changing WinRm posts, run `netstat -aon`. The `-aon` switches: * show all active connections (`a`) * show the process ID for the process that opened the connection (`o`) * do no attempt to resolve any DNS names of destination IPs (`n`) ![Running netstat to find listening connections](https://adamtheautomator.com/wp-content/uploads/2021/01/Netstat.png) Running netstat to find listening connections If a web server is listening on port 80, for example, you’ll see a line where the local address ended in `:80` under the `Local Address` column. This row is where you’ll see the `PID` or process ID the connection is using. Once you know the PID, you can then reference the PID to find the process name using something like the [`Get-Process`](https://adamtheautomator.com/powershell-get-process/ "Get-Process") PowerShell cmdlet. ![Running Get-Process to find process name](https://adamtheautomator.com/wp-content/uploads/2021/01/PID_4.png) Running Get-Process to find process name Although in this case, you can see above that the process name is just _System_. This means that the process is highly integrated within the OS and is probably built into Windows. ### Setting WinRM Compatibility Ports WinRM has a feature called _compatibility ports_. Compatibility ports exist to be backward-compatible with some legacy systems that only work on ports 80 for HTTP and 443 for HTTPS. If you need to change WinRm to listen on these ports, enable the compatibility listeners. Once you know that you do not have anything else running on ports 80 and 443 set the WSMan listeners to use the compatibility ports (80 for HTTP and 443 for HTTPS). ```powershell Set-Item WSMan:\localhost\Service\EnableCompatibilityHttpListener -Value $true Set-Item WSMan:\localhost\Service\EnableCompatibilityHttpsListener -Value $true ``` ### Setting WinRM to Listen on Any Port If, for some reason, you need to configure WinRM to listen on a non-standard port, you can do that too. To do so: 1. Find the listener name. You can do this by enumerating all of the WinRM listeners with the `Get-Item` cmdlet. The command below is listing all (`*`) of the listeners currently installed. ```powershell Get-Item WSMan:\localhost\Listener* ``` ![Getting all existing WinRm listeners](https://adamtheautomator.com/wp-content/uploads/2021/01/Listeners-2.png) Getting all existing WinRm listeners 2\. Next, using the listener name shown above, configure each listener using `Set-Item` providing the path of the listener and the port number to change it to. ```powershell Set-Item WSMan:\localhost\Listener\\Port -Value ``` 3\. At this point, the WinRM listeners are listening on the correct ports, the Windows Firewall is probably rejecting any remote connections to those ports. You need to open those ports. To do so, run the following command. The `New-NetFirewallRule` below is creating a Windows Firewall rule to allow all inbound TCP connections to a custom port. ```powershell $FirewallParam = @{ DisplayName = 'Custom WinRM Port Rule' Direction = 'Inbound' LocalPort = Protocol = 'TCP' Action = 'Allow' Program = 'System' } New-NetFirewallRule @FirewallParam ``` **_Related: [Disable Windows Firewall: Discover the Many Ways](https://adamtheautomator.com/disable-windows-firewall/)_** If you would have _not_ opened the appropriate Windows Firewall port, you would get a message like this when trying to connect: ![Failed WinRM connection due to Windows firewall](https://adamtheautomator.com/wp-content/uploads/2021/01/Session_Firewall_Fail.png) Failed WinRM connection due to Windows firewall ## Connecting to a Custom Port with PSRemoting Now that you’ve set up and configured WinRM successfully on the WinRM server, you need to test connecting with the WinRM client. To do that requires just one additional parameter; `Port`. Using any of the PSRemoting commands like `Invoke-Command` or `Enter-PSSession`, specify the `Port` parameter and the port set up to successfully make a connection. ```powershell Enter-PSSession -ComputerName -Port 1111 ``` ![](https://adamtheautomator.com/wp-content/uploads/2021/01/Session_Success.png) Successful WinRm connection **_Related: [Invoke-Command: The Best Way to Run Remote Code](https://adamtheautomator.com/invoke-command/)_** Share this article [Share on X](https://twitter.com/intent/tweet?url=https%3A%2F%2Fadamtheautomator.com%2Fwinrm-port%2F&text=WinRM%20Ports%3A%20Default%20Settings%20and%20Customization%20Guide)[Share on Facebook](https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fadamtheautomator.com%2Fwinrm-port%2F)[Share on LinkedIn](https://www.linkedin.com/sharing/share-offsite/?url=https%3A%2F%2Fadamtheautomator.com%2Fwinrm-port%2F) ## Related Posts ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b81d9a96fd378dc47c60a/121705eb357e56699bca0c73e19055d636ddcfdd7418053591d9dbf69af050e2.jpg) ### [Audit Every SMB Share Permission with Get-SmbShareAccess](/audit-smb-share-permissions-powershell/) Audit SMB share permissions with Get-SmbShareAccess, flag Everyone and Full Control grants, and check the NTFS ACL before you revoke anything. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b813190efe4fbf5ba49f1/01cf2782293526c501009180bd8555b6e73ab2cef8c62a48d76f7970916c3080.jpg) ### [Migrate DHCP Without Losing Leases with Export-DhcpServer](/migrate-dhcp-server-export-dhcpserver/) Move a DHCP server with Export-DhcpServer and Import-DhcpServer, keeping leases intact, then authorize the new server in Active Directory. ![](https://adamtheautomator.com/wp-content/uploads/publisher/3f95d9c85b2b817aab5dca59f1ca0e14/38378bffb6e067df12a1bd90a3921833213a6e328f7d3baabd1fae698d38ddfd.jpg) ### [Fix Kerberos Clock Skew Logon Failures Using w32tm](/fix-kerberos-clock-skew-w32tm/) Fix Kerberos clock skew logon failures by checking w32tm sources, pointing the PDC emulator at NTP, and resyncing drifted clients. ## Categories * [IT Ops](/category/it-ops/) * [Cloud](/category/cloud/) * [DevOps](/category/devops/) * [Home Ops](/category/home-ops/) * [Information Security](/category/infosec/) * [Software Development](/category/software-development/) ## Site * [Home](/) * [Tutorials](/tutorials/) * [Instructors](/author/) * [Advertising](/advertising/) * [Recommended Resources](/resources/) * [About Adam](/about-adam/) Copyright 2026© ATA Learning | [Privacy Policy](/privacy/)