Port 47001: Windows Remote Management default local listener
IANA registers TCP 47001 as winrm (Windows Remote Management Service), with UDP 47001 reserved. Microsoft's WinRM documentation states that when no WinRM listener has been created, the WinRM service listens for local requests on port 47001. Remote management normally uses the WinRM 2.0 listeners on 5985 (HTTP) and 5986 (HTTPS).
Port Details
Security Exposure
Microsoft documents 47001 only for local requests when no WinRM listener exists, so remote management does not depend on reaching it from other hosts. WinRM sessions can obtain data and execute methods, including WMI operations, so any network path to it should be deliberate and restricted.
Hardening
- +Block inbound 47001 at host and network firewalls; it is not needed for remote management.
- +Configure explicit WinRM listeners on 5986 with HTTPS when remote management is required.
- +Limit WinRM access to administrators and management hosts through Group Policy and firewall scope.
Monitoring
Scan for hosts that answer on 47001 from other network segments, and review WinRM event logs for unexpected remote sessions.
Tools for Auditing and Monitoring WinRM (local)
Sysmon
FreeWindows Sysinternals service that logs detailed process, network, and file activity to the event log.
Microsoft Defender for Endpoint
CommercialMicrosoft enterprise EDR covering Windows, macOS, Linux, and mobile from one console.
Nmap
Free / CommercialNetwork discovery scanner and port auditor for discovering live hosts, open ports, running services, and OS fingerprints.
Related Tool Categories
Frequently Asked Questions
What is port 47001 on Windows?→
It is the port where the WinRM service listens for local requests when no WinRM listener has been created.
Should port 47001 be open?→
It should not be reachable from the network. Remote WinRM management uses 5985 or 5986.
What is the difference between 47001 and 5985?→
5985 is the default WinRM 2.0 HTTP listener for remote management, while 47001 serves local requests when no listener exists.
Sources
Port assignments from the IANA Service Name and Transport Protocol Port Number Registry. Services can be configured to run on any port, so traffic on port 47001 is not guaranteed to be WinRM (local). Exploited-in-the-wild data from the CISA KEV catalog (CC0).