You install a web application, launch a management console or configure an SSL certificate, only to discover that port 443 is already in use. A familiar PowerShell command points to an unhelpful answer: System (PID 4).
Windows is not hiding a normal process. The listener is usually HTTP.sys, a kernel-mode driver used by IIS, Exchange and many management applications. Here is how to identify the service that actually registered the address.
Why netstat and PowerShell show PID 4
When port 80 or 443 is assigned to System (PID 4), the connection is being handled by HTTP.sys, the Windows kernel-mode HTTP API. Applications can register URL prefixes with this driver instead of listening on the port directly. Standard tools therefore attribute the listener to the System process.
Inspect HTTP.sys with netsh
Open Command Prompt or PowerShell as an administrator and run:
netsh http show servicestateThe output can be extensive. Look for the request queue that contains the address you are investigating, for example https://+:443/Console/. Two fields are particularly useful:
- Registered URLs identify the URL prefixes assigned to the queue.
- Process IDs reveal the application process associated with that queue.
Match the PID to the application
Once you have the actual process ID, check it in Task Manager or return to PowerShell:
Get-Process -Id 5432You can then identify the responsible service, review its configuration and decide whether to change the binding or stop the service. The command netsh http show servicestate is one of the fastest ways to diagnose apparently unexplained HTTP and HTTPS port conflicts on Windows Server.