Port 80 is being used by SYSTEM (PID 4), what is that?

Viewed 607608

I am trying to use port 80 for my application server, but when I perform netstat -aon I get:

TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4

When I look up the process in task manager, it shows PID 4 is SYSTEM, that's it. No extension... nothing. Just "SYSTEM". What's going on here?

I'm afraid to end this process, what do I do?

37 Answers

netsh http show urlacl

The command is mentioned in a previous comment but I'd like to bring it up as an answer. It will get you all reserved URLs in the system. If you look through all records with "80" in URL, you shall have your answer.

For example, in my case, I got:

Reserved URL: http://+:80/Temporary_Listen_Addresses/
        User: \Everyone
            Listen: Yes
            Delegate: No
            SDDL: D:(A;;GX;;;WD)

Reserved URL: http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/
        User: NT AUTHORITY\NETWORK SERVICE
            Listen: Yes
            Delegate: No
            SDDL: D:(A;;GX;;;NS)

After a quick Google search, I learnt that "NT AUTHORITY\NETWORK SERVICE" belongs to SQL Server. So I went to Services and stopped SQL Server Reporting Service, port 80 is free again as I check netstat -a -b

This Process works for me:

  1. Right click on My Computer.
  2. Select Manage.
  3. Double click Services and Applications.
  4. Then double-click Services.
  5. Right click on "World Wide Web Publishing Service".
  6. Select Stop
  7. Restart XAMPP

Identify the process programmatically

All the answers to date have required the user to do something interactive. This is how you find the PID when netstat shows you PID 4, without needing to open some GUI or handle a dialogue about depending services.

$Uri = "http://127.0.0.1:8989"    # for example


# Shows processes that have registered URLs with HTTP.sys
$QueueText = netsh http show servicestate view=requestq verbose=yes | Out-String

# Break into text chunks; discard the header
$Queues    = $QueueText -split '(?<=\n)(?=Request queue name)' | Select-Object -Skip 1

# Find the chunk for the request queue listening on your URI
$Queue     = @($Queues) -match [regex]::Escape($Uri -replace '/$')


if ($Queue.Count -eq 1)
{
    # Will be null if could not pick out exactly one PID
    $ProcessId = [string]$Queue -replace '(?s).*Process IDs:\s+' -replace '(?s)\s.*' -as [int]

    if ($ProcessId)
    {
        Write-Verbose "Identified process $ProcessId as the HTTP listener. Killing..."
        Stop-Process -Id $ProcessId -Confirm
    }
}

That really busted my chops. I hate HttpListener and wish I'd just used Pode.

On the lastest version of windows this service is called as "World Wide Web Publishing Service" (W3SVC)

C:\Windows\system32\svchost.exe -k iissvcs

You can stop this service by going to Services (services.msc) and stopping the service and then setting the "Startup type" -> Disabled for preventing it from running on windows startup.

For me it worked after stopping Web Deployment Agent Service.

I stopped World Wide Web Publishing Service and then it worked.

Also, the "developer portal" (on Windows 10) causes System to listen on a TCP port. Usually ports 50080 and 50443.

I just went to service and stopped web deployment agent

After reading every answer on the question and trying everything, to no avail, I uninstalled and reinstalled XAMPP, which worked.

WINDOWS 11

For me it was the World Wide Web Publishing Service who made System use port 80.

Hope this helps new Win11 users.

Related