Port 5985 supports WinRM over HTTP and wsman (UDP reference coverage) across distinct transports. Review each protocol before writing firewall or monitoring policy.
Default Windows Remote Management listener over HTTP transport.
Windows administration, Server Manager, automation and PowerShell remoting.
Client to server
WinRM can encrypt message content after authentication, but HTTPS is preferred across weaker trust boundaries. Restrict administrators and source networks.
wsman (UDP reference coverage) is documented as a network service convention for port 5985 over UDP.
Use this reference entry when identifying or validating systems documented to use 5985/UDP.
Varies
Confirm the listening process and current vendor documentation before permitting traffic; a listed convention does not prove the active service or its security posture.