The WinRM was configured to allow remote administration via a GPO but it wouldn’t let us connect with Enter-PSSession. The firewall rule was there passing the traffic on TCP port 5985.
Checking WinRM config showed something strange:
winrm enumerate winrm/config/listener
Address = *
Transport = HTTP
Port = 5985
Enabled = true
URLPrefix = wsman
ListeningOn = null
So WinRM was actually configured but wasn’t listening on any network interface. Why?