2

I need to have sites running through IIS at port 443 and port 80 but these two ports are used by a System process (PID 4) with a description of NT Kernel & System after I run the netstat -aon command from an elevated command prompt?

What is the problem with this case and how can I end this process because I can't seem to end it.

Ben
  • 31
  • 1
  • 1
  • 2

5 Answers5

2

I assume IIS is already installed on your server.

Part of IIS is the kernel mode driver http.sys which does the actual listening on the ports 80 and 443. Because it is a kernel mode drive, it runs within the system process.

http.sys forwards http requests to the user-mode part of IIS.

So you should be good to go.

Peter Hahndorf
  • 14,058
  • 3
  • 41
  • 58
1

Do not think about ending the System process. It is critical to the functioning of Windows.

According to a similar question on Stack Overflow, below services should be checked for the problem of System process ("NT Kernel & System"; PID: 4) using HTTP/80 port (and HTTPS/443 similarly):

  • Web Deployment Agent Service
  • SQL Server Reporting services
  • IIS
  • World Wide Web Publishing service
  • IIS Admin Service

See if you have any of the above services and running. If you do, check their configurations.

(Yes, IIS is on the list too. You might already have IIS installed along with other applications but you didn't know.)

If you can't figure it out, you may also try browsing http://127.0.0.1 (port 80) and https://127.0.0.1 (port 443) to see if there is any information indicating which applications/services might be serving the web pages.

After finding out the causing applications/services, either remove them from the system or change the port numbers as you see fit.

Community
  • 1
wandersick
  • 318
  • 1
  • 3
  • 11
  • Too bad, none of these are running and the System process is still listening on port 443... Nice overview though... – Wouter Mar 14 '17 at 14:54
0

I'm follow this link https://fujii.github.io/2019/07/12/windows-http-sys-port-80/

netsh http show iplisten 
netsh http delete iplisten ipaddress=0.0.0.0
sysadmin1138
  • 133,124
  • 18
  • 176
  • 300
user1999230
  • 1
  • 1
0

Windows Admin Center also uses 'system' and port 443. This was the issue in may case. And port 80 and/or 443 can be used by Hyper-v Replica.

julien
  • 1
0

PID 4 usually means a native Microsoft based Windows service, which means kernel level.

Try stopping services one by one, and check if it solved the problem.

Disable the service/uninstall the feature that caused the issue.

Usual services are: Routing and RAS, anything noting IIS or World Wide Puplishing, Exchange Windows Sync Share, Web Deployment Agent Service, SQL Server Reporting Services, File Server Storage Reports Manager and similar.

elbedoit
  • 1