Port 80 is being used by SYSTEM (PID 4), what is that?

579,541

Solution 1

the IP adress is 0.0.0.0, state = LISTENING: means that port 80 is listening to all interfaces (not used)

How to read NETSTAT -AN results:

Solution 2

There are many services, which can listen port 80 on windows.

Luckily you can detect and stop them all running simple console command:

NET stop HTTP

When you'll start it, you will get list first: enter image description here

To avoid this problem in future go to Local Services and disable listed services.

N.B. - Some services will restart themselves immediately, just run 'NET stop HTTP' few times.

Solution 3

A new service called "Web Deployment Agent Service" (MsDepSvc) can also trigger "System" with PID=4 to listen on port 80.

Solution 4

Also, try stopping "SQL Server Reporting Services (MSSQLSERVER)", that apparently defaults to 80. I did that and port 80 freed up. PID identified the culprit as "System", but apparently that System can mean multiple things.

Solution 5

I had the same problem. Could fix it by stopping the World Wide Web Publishing Service under running services.

Share:
579,541
GiH
Author by

GiH

Updated on December 01, 2021

Comments

  • GiH
    GiH over 2 years

    I am trying to use port 80 for my application server, but when I perform netstat -aon I get:

    TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4

    When I look up the process in task manager, it shows PID 4 is SYSTEM, that's it. No extension... nothing. Just "SYSTEM". What's going on here?

    I'm afraid to end this process, what do I do?

  • voam
    voam almost 13 years
    I had the exact same problem as original poster. Antony's answer solved my problem as I didn't have reporting services running. I had recently installed WebMatrix so perhaps "Web Deployment Agent Service" got installed as part of that package. In any event, stopping that service freed up port 80. To take port 80 like that seems pretty brazen, to me.
  • Ramesh
    Ramesh almost 13 years
    WebMatrix seems to be the issue here
  • Antony
    Antony over 12 years
    Yes, I can confirm with Jonathan that after installing WebMatrix (and its dependencies via Microsoft Web Platform Installer), the service "Web Deployment Agent Service" shows up. It is indeed not a very friendly design to use up port 80, especially if you also run Apache/IIS server on the same box.
  • Asif Shahzad
    Asif Shahzad almost 12 years
    I am facing the same problem, the port 80 is acquired by NT Kernal. But when I run Apache on port 80, it does (when configured as run-on-startup service). But when I stop Apache, and try to run Tomcat on port 80, Windows 7 do not allow. The NT Kernel or Skype should not use standard web server port.
  • Olivier Faucheux
    Olivier Faucheux over 11 years
    It was on my system the IIS, but the name of the services was "WWW-Publishingdienst" (German one?)
  • despot
    despot about 11 years
    "means that port 80 is listening to all interfaces (not used)" not exactly - the service "World Wide Web Publishing Service" was listening at this port. Once you manually stop it, you might free that port (at least in windows 7)
  • user606669
    user606669 almost 11 years
    great works by stopping web deployment service agent in services on windows 7 professional.
  • daniel__
    daniel__ over 10 years
    Just to clarify, World Wide Web Publishing Service is W3SVC. Stop this service solves my problem.
  • s.s
    s.s over 10 years
    SQL Server Reporting Services was listening on port 80 on my system as well. Thanks!
  • Timofey Drozhzhin
    Timofey Drozhzhin almost 10 years
    To temporarily stop MsDepSvc, go to Run->"Services.msc", right-click on Web Deployment Agent Service, click Stop.
  • Zee
    Zee over 9 years
    you can change skype's default ports from its 'Connection' settings
  • Grynn
    Grynn over 9 years
    You can change the URL for MsDepSvc (Web Deployment Agent Service) here: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\services\MsDepSv‌​c\Parameters
  • icedwater
    icedwater about 9 years
    You might want to add the second, more dangerous way to disable it, for completeness.
  • Alex Coroza
    Alex Coroza over 8 years
    NOTE... run cmd as administrator
  • eselk
    eselk over 8 years
    I started having this problem after installing Azure SDK for VS 2012. It either installs or enables this service, apparently.
  • Auguste
    Auguste about 8 years
    For step 5, my problem was with SQL Server Reporting Service. I turned that off and the problem is resolved. I turned off WWWPublishing services before but that didn't resolve the problem.
  • cchamberlain
    cchamberlain about 8 years
    This works but also stops my ability to host sites on other ports via IIS.
  • ‌‌R‌‌‌.
    ‌‌R‌‌‌. about 8 years
    It will stop the spooler service as well which is responsible for printers.
  • Damodar Bashyal
    Damodar Bashyal almost 8 years
    I started seeing this port 80 after installing MSSql server and didn't realize it until I see your solution. After stopping service all good now. Thx.
  • Perry Tew
    Perry Tew almost 8 years
    I missed the subtle fact that you're presented with a list of running services first and the choice to continue with the stopping of them. This allowed me to see what was running, choose not to stop them all, and then find the suspected service in my Services panel, stop it, and set it to manual. Anton's solution is great. Easy to remember and use.
  • KingRider
    KingRider over 7 years
    GoToMeeting is CitrixOnline too, just uninstall
  • KingRider
    KingRider over 7 years
    @AntonPurin hum ... net STOP http is work... thanks a lot bro... was freezen/stuck xampp.. thanks
  • xorcus
    xorcus over 7 years
    this worked for me as well - the service description says: BranchCache - This service caches network content from peers on the local subnet.
  • Kitet
    Kitet over 7 years
    @despot answer was right on the money in my case - windows 10 pro after upgrading from 7Pro, had part of IIS installed which listened on 80. Netstat and SysInternals' tcpview were of no help.
  • barlop
    barlop over 7 years
    I get the message "The HTTP service could not be stopped."
  • Anton
    Anton over 7 years
    @barlop check if your console runs as Administrator, if yes - I'm not sure what to do
  • barlop
    barlop over 7 years
    -1 PID of 4 no use. C:\blah>netstat -abon | more "Active Connections TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4 Can not obtain ownership information" and after clicking 'show processes from all users' in windows 7 task manager, task manager lists "System" for PID of 4.
  • Anton
    Anton over 7 years
    @barlop this is really odd way to react to people trying to help you
  • Anton
    Anton over 7 years
  • barlop
    barlop over 7 years
    @AntonPurin re the accepted answer in your second link, obviously I know about task manager, but look at this question it's PID 4, have you ever tried killing the process/"process" with PID 4? I don't think you have. I think you'll find that you are not able to. And while there may be a service that can be stopped that'd stop it, that's not in the answer you linked to with your second link. Your second link is just how to kill a process from task manager and not for PID 4.
  • François Breton
    François Breton over 7 years
    Change "Web Service URL" AND "Web Portal URL" in "Reporting Services Configuration Manager" for, let's say, port 82 :-)
  • dugloon
    dugloon about 7 years
    Stopping and disabling the W3SVC service works for me too: sc stop w3svc then sc config w3svc start= disabled
  • DangerPaws
    DangerPaws about 7 years
    This link ( devside.net/wamp-server/… ) helped me narrow down the culprits and finally find what I was looking for. Annoyingly this stackoverflow post didn't popup in my searches until I had solved it.
  • Martin Erlic
    Martin Erlic almost 7 years
    This didn't work for me on Windows Server 2012 R2. The service apparently doesn't even exist so I can't end the process.
  • Stefan
    Stefan almost 7 years
    Thanks I think its the Razer Chroma SDK Server. I disabled it in msconfig and that solved the problem for me!
  • Mircea Ion
    Mircea Ion over 6 years
    LISTENING means used. It means there's a process using that specific port, waiting for incoming calls. I was trying to start the Default Web Site and IIS told me there's another process using port 80. The most voted answer - the one about "Web Deployment Agent Service" (MsDepSvc) - is a better explanation for what's happening.
  • Yirkha
    Yirkha over 6 years
  • Ayub
    Ayub over 6 years
    Better commands to find the culprit: netsh http show urlacl and netsh http show servicestate (look for all the ones with :80 in them.) Source: devside.net/wamp-server/…
  • Aakash Thakur
    Aakash Thakur over 6 years
    Command ran perfectly the first time. But didn't stop the service running on port 80 it seems. It is still showing services running on that port.
  • Anton
    Anton over 6 years
    @AakashThakur try run it few times, some services may be instantly restarted
  • Aakash Thakur
    Aakash Thakur over 6 years
    I ran it a couple of times and it displays The service is starting or stopping. Please try again later.
  • Anton
    Anton over 6 years
    @AakashThakur some service stuck, probably. As a permanent solution you can disable autostart for those services and restart. If you simply need to free port once try to restart and run that command again.
  • Aakash Thakur
    Aakash Thakur over 6 years
    can you please tell me how do I disablwe autostart?\
  • Anton
    Anton over 6 years
    @AakashThakur that link in my answer leads to a manual how to do that
  • David
    David almost 6 years
    The only that worked for me in Windows 10. Have removed all the inbound firewall rules claiming port 80, and still need to issue this command every time i restart de computer.
  • Liam Mitchell
    Liam Mitchell over 5 years
    ReportServer$SQLEXPRESSS2016 was doing this on my pc.
  • Admin
    Admin almost 5 years
    @DangerPaws Thank you for that link! The list of possible services running on port 80 was spot on. For me, BranchCache had for some unknown reason started, and was using port 80.
  • Qwertie
    Qwertie over 4 years
    net stop http apparently lists all registered HTTP services including ones that are not running on port 80. The print spooler, for example, is not on port 80. So you can stop some services manually (Control Panel => Administrative tools => Services) until the port is free. In my case it was one of the SQL server services that used port 80.
  • Fosfor
    Fosfor over 4 years
    This answer is not answering the OP question (i.e. why SYSTEM is listening on port 80). And it is wrong (listening != not used).
  • Amit Beckenstein
    Amit Beckenstein about 4 years
    This article solved my problem with BranchCache
  • Dang Cong Duong
    Dang Cong Duong almost 4 years
    Exactly what I need. Thank you.
  • duct_tape_coder
    duct_tape_coder almost 4 years
    @Ayub Has a good start but if you use netsh http show servicestate view=requestq you can actually see the REAL process id which is calling the port.
  • duct_tape_coder
    duct_tape_coder almost 4 years
    Since this is the marked/top answer but not answering the question, I'll put some actually helpful information here: use netsh http show servicestate view=requestq and check the process id listed that is actually calling the port. You're welcome.
  • Arun Joseph
    Arun Joseph over 3 years
    My Pleasure Dang!
  • AlanC
    AlanC over 3 years
    Windows Server 2019, uninstalled IIS, BranchCache was the culprit. Wanted to run Kestrel using port 80 and it refused to start with an error: Permission denied at System.Net.Sockets.Socket. Hope this helps someone else looking for a solution.
  • Naveen Kumar V
    Naveen Kumar V about 3 years
    Worked in my Azure VM - Windows 10. :)
  • Rohit Kumar
    Rohit Kumar about 3 years
    @Auguste Your solution worked for me, Thanks :)
  • Mikaël Mayer
    Mikaël Mayer almost 3 years
    I did it once in the past and it worked. After a windows update, I had the same problem, and this solution worked for me again ! Thanks @Dung
  • Joe
    Joe over 2 years
    This worked. 'Power BI Report Service' was the problem in my case. 'NT AUTHORITY\NETWORK SERVICE' shows on port 80 also but it and SQL Server are running without conflict with ingresss-nginx on my machine.
  • Joe
    Joe over 2 years
    net stop http doesn't work as AakashThakur pointed out. The HTTP Service service could not be stopped'. Apparently not all users of port 80 are properly registered in the registry and Service configurations vary from machine to machine. Running 'netsh http show urlacl' is the way to trace it down. It displays all 'URL Reservations'. I copied and pasted to notepad++ and searched for ':80' and found numerous but finally traced it down to 'Power BI Report Service' on my machine.
  • Lisa
    Lisa over 2 years
    Okay, so how would you change this?
  • Houssam Oulachgar
    Houssam Oulachgar about 2 years
    Sorry for the late answer @LisaCerilli . You go to the services.msc, search for World Wide Web Publishing Service and disable it.
  • Lisa
    Lisa about 2 years
    Thank you! I have no idea why you were downloaded as this was my EXACT issue on Windows 11.
  • Adrian B.
    Adrian B. about 2 years
    The command from @duct_tape_coder was the one that worked for me. Used that to find the process ID, went to task manager, right click on the columns, select process id, find the appropriate process and kill it. Also, you can look in the Services app to permanently disable it. in my case, it was BranchCache that was using the port.
  • Rupesh Bhurke
    Rupesh Bhurke about 2 years
    I found out that there are many reasons for this to happen hence many solutions. This one worked for me. After reading through I remembered installing SQLEXPRESS just a few days ago. I went to services, stopped and disabled SQL Server Reporting Service.
  • Vesper
    Vesper over 1 year
    Well, the question was to find out what's going on, and your answer goes with "kill it" instead of investigating. However, since it explicitly mentions netsh http show servicestate view=requestq which helps in exactly this situation (the port is opened by system process, but you need to find out what process listens as it's not the "system"), you get a +1.