PID4 (system32/ntoskrnl.exe) blocking the port 80

Question

Hi all,

Recently, we have deployed fresh windows 2016 std Virtual server However, notice that PID4 (system32/ntoskrnl.exe) blocking the port 80. No software is installed on the server. Tried to stop all the possible services like WMI/update/print but still no luck.

Can anyone help how to get the rid of this.

Thanks,

Answer 1

I'd work through this one.
https://fujii.github.io/2019/07/12/windows-http-sys-port-80/

--please don't forget to Accept as answer if the reply is helpful--

Answer 2

Yes, before posting this, i already tried and when i run the command "netsh http delete iplisten 127.0.0.2." , my app able to install However, i still believe this is workaround, not the solution.

However, i did some more research and found "branchcache" service was the culprit.

This is what i get
Reserved URL : http://+:80/0131501b-d67f-491b-9a40-c4bf27bcb4d4/
User: NT AUTHORITY\NETWORK SERVICE
Listen: Yes
Delegate: No
SDDL: D:(A;;GX;;;NS)

Pl refer

https://serverfault.com/questions/751897/port-80-is-being-used-by-microsoft-httpapi-2-0
https://devblogs.microsoft.com/oldnewthing/20180703-00/?p=99145

One last question, Do you see any harm by stopping "branchcache" service. Not sure why MS introduce this with port 80 ?

Thanks for help

Answer 3

Probably should be Ok to disable. Some info here on the service.
https://2pintsoftware.com/microsoftbranchcache/
https://learn.microsoft.com/en-us/windows-server/networking/branchcache/branchcache

a couple 2016 servers I just checked do not have it running.
https://learn.microsoft.com/en-us/powershell/module/branchcache/disable-bc?view=win10-ps

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

Thanks for the quick reply :)