WinRM not not listening on Default Port

Question

I am having some trouble with the default WinRM listener not wanting to use HTTPS port 5986.

Everything appears to be configured correctly:

Winrm get winrm/config

Config
    MaxEnvelopeSizekb = 500
    MaxTimeoutms = 60000
    MaxBatchItems = 32000
    MaxProviderRequests = 4294967295
    Client
        NetworkDelayms = 5000
        URLPrefix = wsman
        AllowUnencrypted = false
        Auth
            Basic = true
            Digest = true
            Kerberos = true
            Negotiate = true
            Certificate = true
            CredSSP = false
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        TrustedHosts
    Service
        RootSDDL = O:NSG:BAD:P(A;;GA;;;BA)(A;;GR;;;IU)S:P(AU;FA;GA;;;WD)(AU;SA;GXGW;;;WD)
        MaxConcurrentOperations = 4294967295
        MaxConcurrentOperationsPerUser = 1500
        EnumerationTimeoutms = 240000
        MaxConnections = 300
        MaxPacketRetrievalTimeSeconds = 120
        AllowUnencrypted = false
        Auth
            Basic = true
            Kerberos = true
            Negotiate = true
            Certificate = false
            CredSSP = false
            CbtHardeningLevel = Relaxed
        DefaultPorts
            HTTP = 5985
            HTTPS = 5986
        IPv4Filter = * [Source="GPO"]
        IPv6Filter [Source="GPO"]
        EnableCompatibilityHttpListener = true [Source="GPO"]
        EnableCompatibilityHttpsListener = true [Source="GPO"]
        CertificateThumbprint
        AllowRemoteAccess = true [Source="GPO"]
    Winrs
        AllowRemoteShellAccess = true
        IdleTimeout = 7200000
        MaxConcurrentUsers = 2147483647
        MaxShellRunTime = 2147483647
        MaxProcessesPerShell = 2147483647
        MaxMemoryPerShellMB = 2147483647
        MaxShellsPerUser = 2147483647

However when I enumerate the listeners its HTTPS listener is on 443 instead of the configured default port. No amount of rebooting or trying to change it has helped.

winrm enumerate winrm/config/Listener
Listener [Source="GPO"]
    Address = *
    Transport = HTTP
    Port = 5985
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = <REMOVED>

Listener [Source="Compatibility"]
    Address = *
    Transport = HTTP
    Port = 80
    Hostname
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint
    ListeningOn = <REMOVED>

Listener [Source="Compatibility"]
    Address = *
    Transport = HTTPS
    Port = 443
    Hostname = <REMOVED>
    Enabled = true
    URLPrefix = wsman
    CertificateThumbprint = <REMOVED>
    ListeningOn = <REMOVED>

I checked and there are no other services listening on port 5986 that would be causing a conflict. The system is just choosing not to listen for some reason on the default port.

Answer 1

I finally found the solution to this.

#https://gist.github.com/bender-the-greatest/3e2f6e6d606eebaeedbacd8722e52396

if(!$($(Winrm enumerate winrm/config/listener) -match "Port = 5986")){
    winrm create winrm/config/listener?Address=*+Transport=HTTPS
}

Answer 2

Have you checked the GPO? Should it be adding another Listener for HTTPs on 5986? I only see the HTTP/5985 port.

What does this show? netstat -ano | findstr 5986

What about firewall rules? Can you disable the firewall on the machine and then restart the WinRM service.

Verify from the "ListeningOn" section that port 5986 isn't just listening on IP address 127.0.0.1. You can also use 'netsh http show iplisten' to see

Answer 3

I already mentioned that I check for anything else listening on that port and there was not.

PS C:\WINDOWS\system32> netstat -ano | findstr 5986
PS C:\WINDOWS\system32>

I'm not even dealing with the firewall rule yet the listener is not running on the correct port.

Answer 4

Hello @Justin Yaple

Did you left the IPv4 and IPv6 filter settings blank ?

"if you leave filters blank you still enable remote management but the listener does not know on which interface to bind itself."

This blog might help :WinRM would not listen on port 5985

Best Regards
Karlie

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Answer 5

Hello @Justin Yaple

Please check this setting: EnableCompatibilityHttpsListener.

According to this article, It Specifies whether the compatibility HTTPS listener is enabled. If this setting is True, then the listener will listen on port 443 in addition to port 5986. The default is False.

The GPO will override or block any changes you try to make.

Best Regards
Karlie

----------

If the Answer is helpful, please click "Accept Answer" and upvote it.
Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.