438

I am trying to use port 80 for my application server, but when I perform netstat -aon I get:

TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4

When I look up the process in task manager, it shows PID 4 is SYSTEM, that's it. No extension... nothing. Just "SYSTEM". What's going on here?

I'm afraid to end this process, what do I do?

3

37 Answers 37

333

There are many services, which can listen port 80 on windows.

Luckily you can detect and stop them all running simple console command:

NET stop HTTP

When you'll start it, you will get list first: enter image description here

To avoid this problem in future go to Local Services and disable listed services.

N.B. - Some services will restart themselves immediately, just run 'NET stop HTTP' few times.

20
  • 6
    NOTE... run cmd as administrator Oct 27, 2015 at 3:37
  • 4
    It will stop the spooler service as well which is responsible for printers. Mar 25, 2016 at 10:20
  • 8
    I missed the subtle fact that you're presented with a list of running services first and the choice to continue with the stopping of them. This allowed me to see what was running, choose not to stop them all, and then find the suspected service in my Services panel, stop it, and set it to manual. Anton's solution is great. Easy to remember and use.
    – Perry Tew
    Jun 12, 2016 at 21:26
  • 1
    @barlop this is really odd way to react to people trying to help you
    – Anton
    Nov 16, 2016 at 8:42
  • 8
    Better commands to find the culprit: netsh http show urlacl and netsh http show servicestate (look for all the ones with :80 in them.) Source: devside.net/wamp-server/…
    – Ayub
    Nov 27, 2017 at 1:07
305

A new service called "Web Deployment Agent Service" (MsDepSvc) can also trigger "System" with PID=4 to listen on port 80.

6
  • 4
    I had the exact same problem as original poster. Antony's answer solved my problem as I didn't have reporting services running. I had recently installed WebMatrix so perhaps "Web Deployment Agent Service" got installed as part of that package. In any event, stopping that service freed up port 80. To take port 80 like that seems pretty brazen, to me.
    – voam
    May 20, 2011 at 14:37
  • 7
    WebMatrix seems to be the issue here
    – Jonathan
    May 23, 2011 at 17:46
  • 5
    Yes, I can confirm with Jonathan that after installing WebMatrix (and its dependencies via Microsoft Web Platform Installer), the service "Web Deployment Agent Service" shows up. It is indeed not a very friendly design to use up port 80, especially if you also run Apache/IIS server on the same box.
    – Antony
    Jul 7, 2011 at 18:03
  • To temporarily stop MsDepSvc, go to Run->"Services.msc", right-click on Web Deployment Agent Service, click Stop. Apr 11, 2014 at 18:56
  • 2
    You can change the URL for MsDepSvc (Web Deployment Agent Service) here: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MsDepSvc\Parameters
    – Grynn
    Nov 14, 2014 at 13:23
260

Also, try stopping "SQL Server Reporting Services (MSSQLSERVER)", that apparently defaults to 80. I did that and port 80 freed up. PID identified the culprit as "System", but apparently that System can mean multiple things.

3
  • 7
    SQL Server Reporting Services was listening on port 80 on my system as well. Thanks!
    – afournier
    Dec 10, 2013 at 16:51
  • 2
    I started seeing this port 80 after installing MSSql server and didn't realize it until I see your solution. After stopping service all good now. Thx. Apr 28, 2016 at 2:03
  • 7
    Change "Web Service URL" AND "Web Portal URL" in "Reporting Services Configuration Manager" for, let's say, port 82 :-) Nov 17, 2016 at 3:21
97

I had the same problem. Could fix it by stopping the World Wide Web Publishing Service under running services.

3
  • great works by stopping web deployment service agent in services on windows 7 professional.
    – user606669
    Jun 10, 2013 at 9:47
  • This works but also stops my ability to host sites on other ports via IIS. Mar 7, 2016 at 2:53
  • This didn't work for me on Windows Server 2012 R2. The service apparently doesn't even exist so I can't end the process. Apr 9, 2017 at 19:16
44

the IP adress is 0.0.0.0, state = LISTENING: means that port 80 is listening to all interfaces (not used)

How to read NETSTAT -AN results:

10
  • 64
    "means that port 80 is listening to all interfaces (not used)" not exactly - the service "World Wide Web Publishing Service" was listening at this port. Once you manually stop it, you might free that port (at least in windows 7)
    – despot
    Jan 28, 2013 at 12:45
  • 35
    Just to clarify, World Wide Web Publishing Service is W3SVC. Stop this service solves my problem.
    – daniel__
    Aug 8, 2013 at 22:41
  • 27
    Stopping and disabling the W3SVC service works for me too: sc stop w3svc then sc config w3svc start= disabled
    – dugloon
    Jan 31, 2017 at 22:34
  • 3
    LISTENING means used. It means there's a process using that specific port, waiting for incoming calls. I was trying to start the Default Web Site and IIS told me there's another process using port 80. The most voted answer - the one about "Web Deployment Agent Service" (MsDepSvc) - is a better explanation for what's happening.
    – Mircea Ion
    Jul 26, 2017 at 23:56
  • 3
    Since this is the marked/top answer but not answering the question, I'll put some actually helpful information here: use netsh http show servicestate view=requestq and check the process id listed that is actually calling the port. You're welcome. Jun 25, 2020 at 20:35
37

This works for me:

  1. Right click on My Computer.
  2. Select Manage.
  3. Double click Services and Applications.
  4. Then double click Services.
  5. Right click on "World Wide Web Publishing Service".
  6. Select Stop.
3
  • 3
    For step 5, my problem was with SQL Server Reporting Service. I turned that off and the problem is resolved. I turned off WWWPublishing services before but that didn't resolve the problem.
    – Auguste
    Jan 25, 2016 at 23:17
  • ReportServer$SQLEXPRESSS2016 was doing this on my pc. Aug 11, 2018 at 0:06
  • @Auguste Your solution worked for me, Thanks :) Mar 24, 2021 at 7:52
37

Working solution - tested on Windows 10

There are many reasons for this, the one cause/solution I recommended is this:

Open Command line as Administrator, then:

  1. stop http service

net stop http /y

  1. configure 'http' service to be disable by default

sc config http start=disabled

If above solution does not work, find your specific case - here

Restart your web server/XAMPP/Apache and you're done.


To re-enable http service

use

sc config HTTP start= demand

the source of explanation is here

https://web.archive.org/web/20190917190806/http://servicedefaults.com/10/http/

1
  • I did it once in the past and it worked. After a windows update, I had the same problem, and this solution worked for me again ! Thanks @Dung Apr 30, 2021 at 7:30
33

It sounds like IIS is listening to port 80 for HTTP requests.

Try stopping IIS by going into Control Panel/Administrative Tools/Internet Information Services, right-clicking on Default Web Site, and click on the Stop option in the popup menu, and see if the listener on port 80 has cleared.

1
  • It was on my system the IIS, but the name of the services was "WWW-Publishingdienst" (German one?) Aug 17, 2012 at 9:49
30

This can be very easily fixed by following these five steps:

  1. Open Services
  2. Right click on World Wide Web Publishing Service
  3. Click STOP

To prevent this issue in future :

  1. Go to Properties
  2. Change Startup type to Manual

Viola u are good to go !

For more info on root cause: https://serverfault.com/questions/65717/port-80-is-being-used-by-system-pid-4-what-is-that

3
27

I've found out that "SQL Server Reporting Services (MSSQLSERVER)" starts automatically and listens on port 80.

I hope this helps.

O

0
21

An other service that could occupied the port 80 is BranchCache

services.msc showing it as "BranchCache"

or use the net command to stop the service like

net stop PeerDistSvc

Update:

PeerDistSvc is a service behind svhost.exe, to view svchost services type

tasklist /svc /fi "imagename eq svchost.exe"
4
  • this worked for me as well - the service description says: BranchCache - This service caches network content from peers on the local subnet.
    – xorcus
    Sep 21, 2016 at 12:52
  • MSDN: BranchCache Overview
    – Yirkha
    Nov 6, 2017 at 11:42
  • This article solved my problem with BranchCache Jan 12, 2020 at 9:31
  • Windows Server 2019, uninstalled IIS, BranchCache was the culprit. Wanted to run Kestrel using port 80 and it refused to start with an error: Permission denied at System.Net.Sockets.Socket. Hope this helps someone else looking for a solution.
    – AlanC
    Oct 10, 2020 at 6:33
15

The issue is how to free it up, simply use

net stop http

https://stackoverflow.com/a/16243333/777982

0
10

I knew these answers were right , but my services.msc was not showing the services, however this did the trick:

sc stop "MsDepSvc" 
sc config "MsDepSvc" start= disabled 
1
  • Worked in my Azure VM - Windows 10. :) Jan 18, 2021 at 12:15
7

netsh http show urlacl

The command is mentioned in a previous comment but I'd like to bring it up as an answer. It will get you all reserved URLs in the system. If you look through all records with "80" in URL, you shall have your answer.

For example, in my case, I got:

Reserved URL: http://+:80/Temporary_Listen_Addresses/
        User: \Everyone
            Listen: Yes
            Delegate: No
            SDDL: D:(A;;GX;;;WD)

Reserved URL: http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/
        User: NT AUTHORITY\NETWORK SERVICE
            Listen: Yes
            Delegate: No
            SDDL: D:(A;;GX;;;NS)

After a quick Google search, I learnt that "NT AUTHORITY\NETWORK SERVICE" belongs to SQL Server. So I went to Services and stopped SQL Server Reporting Service, port 80 is free again as I check netstat -a -b

2
  • This worked. 'Power BI Report Service' was the problem in my case. 'NT AUTHORITY\NETWORK SERVICE' shows on port 80 also but it and SQL Server are running without conflict with ingresss-nginx on my machine.
    – Joe
    Oct 14, 2021 at 13:40
  • I found out that there are many reasons for this to happen hence many solutions. This one worked for me. After reading through I remembered installing SQLEXPRESS just a few days ago. I went to services, stopped and disabled SQL Server Reporting Service. Mar 21, 2022 at 6:31
6

Identify the process programmatically

All the answers to date have required the user to do something interactive. This is how you find the PID when netstat shows you PID 4, without needing to open some GUI or handle a dialogue about depending services.

$Uri = "http://127.0.0.1:8989"    # for example


# Shows processes that have registered URLs with HTTP.sys
$QueueText = netsh http show servicestate view=requestq verbose=yes | Out-String

# Break into text chunks; discard the header
$Queues    = $QueueText -split '(?<=\n)(?=Request queue name)' | Select-Object -Skip 1

# Find the chunk for the request queue listening on your URI
$Queue     = @($Queues) -match [regex]::Escape($Uri -replace '/$')


if ($Queue.Count -eq 1)
{
    # Will be null if could not pick out exactly one PID
    $ProcessId = [string]$Queue -replace '(?s).*Process IDs:\s+' -replace '(?s)\s.*' -as [int]

    if ($ProcessId)
    {
        Write-Verbose "Identified process $ProcessId as the HTTP listener. Killing..."
        Stop-Process -Id $ProcessId -Confirm
    }
}

That really busted my chops. I hate HttpListener and wish I'd just used Pode.

1
  • Well, the question was to find out what's going on, and your answer goes with "kill it" instead of investigating. However, since it explicitly mentions netsh http show servicestate view=requestq which helps in exactly this situation (the port is opened by system process, but you need to find out what process listens as it's not the "system"), you get a +1.
    – Vesper
    Jul 7, 2022 at 13:13
4

I just got this problem today, since it showed up after Norton requested reboot I blamed Norton.
But it wasn't Norton, I removed Norton, rebooted -> problem still there.

netstat -nao was showing that PID 4 owned my port 80 connection.

I then went to control panel, then "Turn Windows features on or off" then unchecked Internet Information Services.
Rebooted, the problem went away.
My xampp server is running ok now.

I don't ever remembering turning IIS on in the first place. I had been running many months before this happened. I still don't know what caused it in the first place. Maybe a previous windows updated enabled iis and my reboot turned it on, I don't know.

4

This Process works for me:

  1. Right click on My Computer.
  2. Select Manage.
  3. Double click Services and Applications.
  4. Then double-click Services.
  5. Right click on "World Wide Web Publishing Service".
  6. Select Stop
  7. Restart XAMPP
4

On the lastest version of windows this service is called as "World Wide Web Publishing Service" (W3SVC)

C:\Windows\system32\svchost.exe -k iissvcs

You can stop this service by going to Services (services.msc) and stopping the service and then setting the "Startup type" -> Disabled for preventing it from running on windows startup.

3

I had this same exact problem, except that i have never used IIS. While I was fixing another system bug, I had set the apache service to manual start, hoping to reduce the complexity of my system. After I fixed the other bug, apache wouldn't start. I futzed for a while, but all it took was setting apache back to automatic start: Start > Administrative Tools > Services.

Apparently when Apache starts this way, it claims port 80 before the SYSTEM process can.

hth someone. all my googling turned up the 'can't have IIS and Apache on the same machine.' this is for the other one percent of us.

3

For me it worked after stopping Web Deployment Agent Service.

2

In case you use Razer product and install Razer Synapse software on your PC, it blocks the port 80 too.

It is not included in the netstat command so I am not able to troubleshoot it. Since there are many services included within the software, I can't analyze which one that blocks the port. After uninstalling the Razer Synapse, I can start the Apache server again on Windows 10.

1
  • Thanks I think its the Razer Chroma SDK Server. I disabled it in msconfig and that solved the problem for me!
    – Stefan
    Jun 23, 2017 at 14:20
1

Try netstat -b, that may hopefully shed some light on the situation (showing what .exe is using the port). Good luck.

2
  • it wasn't even showing up in netstat -b, weird, but anyway I've solved it, look for the update.
    – GiH
    Sep 15, 2009 at 23:50
  • -1 PID of 4 no use. C:\blah>netstat -abon | more "Active Connections TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 Can not obtain ownership information" and after clicking 'show processes from all users' in windows 7 task manager, task manager lists "System" for PID of 4.
    – barlop
    Nov 16, 2016 at 6:59
1

This wouldn't explain the PID side of things, but if you run Skype, it likes to use Port 80 for some reason.

2
  • I am facing the same problem, the port 80 is acquired by NT Kernal. But when I run Apache on port 80, it does (when configured as run-on-startup service). But when I stop Apache, and try to run Tomcat on port 80, Windows 7 do not allow. The NT Kernel or Skype should not use standard web server port. Jun 13, 2012 at 8:49
  • you can change skype's default ports from its 'Connection' settings
    – Zee
    Sep 10, 2014 at 8:47
1

In my case, it happened after installing Microsoft Web Matrix. Uninstalling this trash along with "Microsoft Web Deploy" fixed the issue.

1

I was looking around for PID 4 and came to this question. From this answer and a blog post I figured that anything to do with PID 4 is probably a Windows Service, so you may want to look for the relevant services in services.msc.

Also, this process is run by System, which is considered another "logged-on" user.

0
1

I had the same problem and it was because of IIS running on the server, you can stop it using IIS Manager if it is the case for you.

1

If you are running Windows Server 2012 R2 then make sure to get rid of Work Folders: http://blogs.technet.com/b/filecab/archive/2013/10/15/windows-server-2012-r2-resolving-port-conflict-with-iis-websites-and-work-folders.aspx Removing Work Folders feature under File Server worked for me.

1

None of these worked for me. I had to go to a SuperUser question.

If it is a System Process—PID 4—you need to disable the HTTP.sys driver which is started on demand by another service, such as Windows Remote Management or Print Spooler on Windows 7 or 2008.

There is two ways to disable it but the first one is safer:

    • Go to device manager, select “show hidden devices” from menu/view, go to “Non-Plug and Play Driver”/HTTP, double click it to disable it (or set it to manual, some services depended on it).

    • Reboot and use netstat -nao | find ":80" to check if 80 is still used.

This is the one that worked for me!

1
  • You might want to add the second, more dangerous way to disable it, for completeness.
    – icedwater
    Dec 29, 2014 at 3:13
1

BranchCache was my problem. My resolution was to run Powershell as an administrator and run:

Disable-BC -Force

Reference: https://learn.microsoft.com/en-us/powershell/module/branchcache/disable-bc?view=win10-ps

1

WINDOWS 11

For me it was the World Wide Web Publishing Service who made System use port 80.

Hope this helps new Win11 users.

3
  • Okay, so how would you change this?
    – Lisa
    Dec 5, 2021 at 0:55
  • 1
    Sorry for the late answer @LisaCerilli . You go to the services.msc, search for World Wide Web Publishing Service and disable it. Feb 9, 2022 at 9:07
  • Thank you! I have no idea why you were downloaded as this was my EXACT issue on Windows 11.
    – Lisa
    Feb 16, 2022 at 17:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.