Today I've tried to start the Visual Studio Developer IIS as usual on Port 80, but this time it has quit with an error that port 80 is already in use. With netstat I've found out, that an application C:/Windows/System32/ntoskrnl.exe is using port 80. My OS is Windows 7 Prof. SP 1.

Has anyone an idea why this application is blocking port 80? Testing ntoskrnl.exe on https://www.virustotal.com/ has found no infections.

closed as off-topic by TildalWave, NULLZ, Xander, Scott Pack, AviD Dec 10 '13 at 20:33

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "Questions about general computing hardware and software are off-topic here, but can be asked on Super User." – TildalWave, NULLZ, Xander, Scott Pack, AviD
If this question can be reworded to fit the rules in the help center, please edit the question.

  • 1
    Have you tried visiting localhost in a browser? – rook Apr 3 '12 at 15:44
  • What kernel are you using? It's likely that someone "impersonates" the NT kernel and that your real kernel has one of the common alternate names (such as ntkrnlpa.exe). Check whether ntoskrnl.exe on your system is even a native image or perhaps GUI/CUI. – 0xC0000022L Apr 3 '12 at 20:07
  • ok, thanks for your advice. (I have to wait 20h until I can accept the answer...) – philsch Apr 4 '12 at 10:56

I've found out that there was an instance of IIS running on my system (not the developer version that is started by Visual Studio, but the standalone version that can be installed via "Turn Windows features on and off"). This causes ntoskrnl.exe to use port 80. Sorry for the false alarm ;)


Hmm ntoskrnl.exe is the windows Kernel and honestly it doesn't have a very good reason for binding to port 80. It is a common target of advanced malware and viruses so I would be weary, but as usual it could be a false positive.

Try restarting, then apply all windows updates, then restart again. Is it still bound to port 80? If so I would repair it with the original versions from your installation DVD like so:

Insert the DVD and boot to it
Open a command prompt.
Restore ntoskrnl.exe and ntkrnlpa.exe from the DVD to %windir%\system32\

You will want to run updates again after restoring those files.

Let me know what you find! Hopefully its just a fluke :)


I was experiencing similar symptoms where port 80 was being used by the ntoskrnl process. In my case, the Web Deployment Agent Service was hogging port 80. I fixed it by disabling the service and changing its startup type from automatic to manual. See http://www.sitepoint.com/unblock-port-80-on-windows-run-apache/.

  • How did you find out that this was tied to ntoskrnl.exe? – T.Woody Sep 19 at 15:21
  • I don't remember how I did it at the time. One way is to run netstat -ao from the command line to find the process ID (PID column). Then, open Task Manager and locate the matching PID under Services or Details. There are some other suggestions at superuser.com/q/246214. – Mike Henry Sep 19 at 18:42

Not the answer you're looking for? Browse other questions tagged or ask your own question.