Ports Used by Windows Services
Alerter
Service Name: Alerter
Executable Name: svchost.exe -k LocalService
Log On As: LocalService
Description: The Alerter service notifies selected users and computers of administrative alerts.
Port Numbers used:
TCP: 2869, dynamic
UDP: 1900
Application Layer Gateway Service
Service Name: ALG
Executable Name: ALG.EXE
Log On As: LocalService
Description This subcomponent of the Internet Connection Sharing (ICS) / Internet Connection Firewall (ICF)
service provides support for independent software vendors (ISVs) to write protocol plug-ins that allow their
proprietary network protocols to pass through the firewall and work behind ICS. Application Layer Gateway
plug-ins have the power to open ports and change data (such as ports and IP addresses) embedded in packets.
IP Port Numbers used:
TCP: 21, dynamically allocated
Application Management
Service Name: AppMgmt
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides software installation services, such as Assign, Publish, and Remove. This service processes requests to enumerate, install, and remove applications deployed via a corporate network.
IP Port Numbers used: None
ASP .NET State Service
Service Name: Aspnet_state
Executable Name: aspnet_state.exe
Log On As: Network Service
Description: ASP State Service provides support for out-of-process session states for ASP. ASP has a concept of session state – a listing of values associated with the client session is accessible from ASP pages through the Session property. There are three options provided to store session data: In process; SQL database; and out-of process. The ASP State Service stores session data out-of-process. The service communicates with ASP using sockets.
IP Port Numbers used:
TCP: 42424
Automatic Updates
Service Name: Wuauserv
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Enables the download of updates from Microsofts Windows Update Web site.
This service keeps your computer up-to-date automatically with the latest updates, drivers and enhancements from Microsoft.
IP Port Numbers used:
TCP: 80
Background Intelligent Transfer Service
Service Name: BITS
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Use Background Intelligent Transfer Service (BITS) to transfer files asynchronously between a client and an HTTP server. BITS is a background file transfer mechanism and queue manager. IP Port Numbers used:
TCP: 80
Certificate Service
Service Name: CertSvc
Executable Name: CERTSVC.EXE
Log On As: LocalSystem
Description: Part of the core operating system that enables a business to act as if its own certificate authority (CA), and issue and manage digital certificates for applications such as Secure/Multipurpose Internet Mail Extensions (S/MIME), Secure Sockets Layer (SSL), Encrypting File System (EFS), IP Security (IPSEC), and smartcard log on.
IP Port Numbers used:
TCP: 1117
Client Service for NetWare
Service Name: NWCWorkstation
Executable Name: svchost.exe -k netsvcs
Log On As: LocalService
Description: Provides access to files and directories as well as resources on NetWare networks.
IP Port Numbers used:
UDP: 213 (IPX Over IP)
Clipbook
Service Name: ClipSrv
Executable Name: clipsrv.exe
Log On As: LocalSystem
Description: Enables the Clipbook Viewer to create and share “pages” of data to be viewed by remote computers.
IP Port Numbers used: None
Cluster Service
Service Name: ClusSvc
Executable Name: Clussvc.exe
Log On As: Domain account specified when cluster service is configured
Description: Server clusters provide high availability and scalability for mission-critical applications such as databases, messaging systems, and file and print services. IP Port Numbers used:
TCP: 3343
UDP: 1204, 1094, 2036, 2008, 3343
COM+ Event System
Service Name: EventSystem
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides automatic distribution of events to subscribing COM (Component Object Model) components. COM+ Events extend the COM+ programming model to support late-bound events or method calls between the publisher or subscriber and the event system. Instead of repeatedly polling the server, the event system notifies interested parties as information becomes available.
IP Port Numbers used: None
COM+ System Application
Service Name: COMSysApp
Executable Name: dllhost.exe /Processid:{02D4B3F1-FD88-11D1-960D-00805FC79235}
Log On As: LocalSystem
Description: The COM+ system application hosts COM+ services and manages COM+ application configuration and tracking.
IP Port Numbers used: None
Computer Browser
Service Name: Browser
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Maintains an up-to-date list of computers on your network, and supplies the list to programs that request it.
IP Port Numbers used:
TCP: 139
UDP: 137(browsing requests of NETBIOS over TCP/IP), 138 (browsing datagram responses of NetBios over
TCP/IP)
Cryptographic Services
Service Name: CryptSvc
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides key management services for your computer. The Cryptographic Service is comprised of three management services: Catalog Database Service, Protected Root Service, and Key Service.
IP Port Numbers used: None
DHCP Client
Service Name: Dhcp
Executable Name: svchost.exe -k netsvcs
IP Port Numbers used:
TCP: 68
UDP: 67, 68, 1029
DHCP Server
Service Name: DHCPServer
Executable Name: tcpsvcs.exe
Log On As: LocalSystem
Description: The DHCP Server service allocates IP addresses and allows the advanced configuration of network settings such as DNS servers, WINS servers to DHCP clients automatically.
IP Port Numbers used:
TCP: 7, 9, 13, 17, 19, 135 (DHCP Manager) 515, 2535, 2856
UDP: 67, 68
Distributed File System
Service Name: DFS
Executable Name: dfssvc.exe
assignment.
Description: The Distributed File System (DFS) service manages logical volumes distributed across a local or wide area network. DFS is a single hierarchical file system, the contents of which are distributed across the network. DFS provides a logical tree structure for file system resources that may be anywhere on the network.
IP Port Numbers used:
TCP: 137 (name lookup), 139
UDP: None
Distributed Link Tracking Client
Service Name: Trkwrks
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Maintains links between the NTFS file system files within a computer or across computers in a network domain. The IP Port Numbers used: None
Distributed Link Tracking Server
Service Name: TrkSrv
Executable Name: svchost.exe -k netsvcs
•Log On As: LocalSystem
Description: The distributed link tracking server runs on each domain controller in a domain. The service accepts notifications of file and volume moves from the tracking service on a computer and allows the distributed link tracking client to query a link source’s current location.IP Port Numbers used: None
Distributed Transaction Coordinator
Service Name: MSDTC
Executable Name: msdtc.exe
Log On As: NetworkService
Description: Coordinates transactions that are distributed across multiple computer systems and/or resource managers, such as databases, message queues, file systems, or other transaction-protected resource managers.
IP Port Numbers used: None
DNS Client
Service Name: Dnscache
Executable Name: svchost.exe -k NetworkService
Log On As: NetworkService
Description: The Domain Name System (DNS) client service resolves and caches DNS names. The DNS client service must be running on every computer that will perform DNS name resolution. IP Port Numbers used:
TCP: 53
DNS Server
Service Name: DNS
Executable Name: dns.exe
Log On As: LocalSystem
Description: Enables DNS name resolution by answering queries and update requests for DNS names.IP Port Numbers used:
TCP: 53, 139 (DNS ADMINISTRATION) 1024, 1043, 1067, 1068
UDP: 53, 1046, 1045
Error Reporting Service
Service Name: ERSvc
Executable Name: svchost.exe –k netsvcs
Log On As: LocalSystem
Description: The Error Reporting Service provides an infrastructure for collecting, storing and reporting kernel mode, operating system and application faults to Microsoft. Error reporting helps Microsoft track and address errors.
IP Port Numbers used:
TCP: 80
Event Log
Service Name: Eventlog
Executable Name: services.exe
Log On As: LocalSystem
Description: This service logs event messages issued by programs and the Windows operating system. IP Port Numbers used:
TCP: 139
Fast User Switching Compatibility
Service Name: FastUserSwitchingCompatibility
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides management services for applications that require assistance in a multiple user environment.
IP Port Numbers used: None
File Replication
Service Name: NtFrs
Executable Name: ntfrs.exe
Log On As: LocalSystem
Description: Enables files to be automatically copied and maintained simultaneously on multiple servers. IP Port Numbers used:
TCP: dynamically allocated
UDP: 1024 - 65535
File Server for Macintosh
Service Name: MacFile
IP Port Numbers used:
TCP: 548
UDP: 548
FTP Publishing Service
Service Name: MSFtpsvc
Executable Name: inetinfo.exe
Log On As: NetworkService
Description: Provides File Transfer Protocol (FTP) connectivity and administration through the Internet Information Service (IIS) snap-in.
IP Port Numbers used:
TCP: 20 (data), 21
Help and Support
Service Name: Helpsvc
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides Help and Support application and framework functionality.
The help service supports the Help and Support Center application and enables communication between the client application and the help data it accesses. IP Port Numbers used:
TCP: 80
HTTP SSL
Service Name: HTTPFilter
Executable Name: lsass.exe
Log On As: LocalSystem
Description: Enables Internet Information Services (IIS) to perform Secure Sockets Layer (SSL) functions. IP Port Numbers used:
TCP: 43, 445
UDP: 443
Human Interface Device Access
Service Name: Hidserv
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: This service provides generic access to specific functions contained within controls collections on HID (Human Interface Devices).
IP Port Numbers used: None
IAS Jet Database Access
Service Name: IASjet
Executable Name: svchost.exe –k iasjet
Log On As: LocalSystem
Description: The IAS Jet Database Access service uses the Remote Authentication Dial-in User Service (RADIUS) protocol to provide authentication, authorization, and accounting services. With IAS, you can centrally manage the authentication, authorization, and accounting of users. IP Port Numbers used: None
IIS Admin Service
Service Name: IISADMIN
Executable Name: inetinfo.exe
Log On As: LocalSystem
Description: IIS Admin service manages the IIS metabase and updates the Microsoft Windows operating system registry for the WWW service, FTP service, SMTP service, and NNTP service. The metabase is a data store that holds IIS configuration data. IP Port Numbers used:
TCP: 80
UDP: 80
IMAPI CD-Burning COM Service
Service Name: ImapiService
Executable Name: imapi.exe
Log On As: LocalSystem
Description: This service manages burning CDs through the IMAPI (Image Mastering Applications Programming Interface) COM interface and performs CD-R writes when requested by the user through Windows explorer, WMP (Windows Media Player) or 3rd party applications which use this API.IP Port Numbers used: None
Indexing Service
Service Name: cisvc
Executable Name: cisvc.exe
Log On As: LocalSystem
Description: Indexes contents and properties of files on local and remote computers and provides rapid access to files through a flexible querying language.
IP Port Numbers used:
TCP: 80
Infrared Monitor
Service Name: Irmon
Executable Name: svchost.exe –k netsvcs
Log On As: LocalSystem
Description: Supports infrared devices installed on the computer and detects other devices that are in range.
IP Port Numbers used: None
Internet Authentication Service
Service Name: IAS
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Performs centralized authentication, authorization, auditing, and accounting of users who are connecting to a network (LAN or remote) using VPN (Virtual Private Network) equipment, RAS (Remote Access Service) equipment, or 802.1X Wireless and Ethernet/Switch Access Points. Internet Authentication Service implements the IETF standard RADIUS (Remote Authentication Dial-In User Service) protocol, which enables use of heterogeneous network access equipment.
IP Port Numbers used:
TCP: None
UDP: 1645, 1646, 1812, 1813
Internet Connection Firewall (ICF) Service Name: SharedAccess
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides NAT (network address translation), addressing and name resolution services for all computers on your home or small-office network through a dial-up or broadband connection. IP Port Numbers used:
TCP: 53, 67
UDP: None
Intersite Messaging
Service Name: IsmServ
Executable Name: ismserv.exe
Log On As: LocalSystem
Description: Intersite Messaging enables messages to be exchanged between computers running Windows Server sites. IP Port Numbers used:
TCP: 1863
IPv6 Helper Service
Service Name: 6to4
Executable Name: svchost.exe –k netsvcs
Log On As: LocalSystem
Description: Offers IPv6 connectivity over an existing IPv4 network. 6to4 allows IPv6-enabled sites and hosts to communicate by using IPv6 over an IPv4 infrastructure (for example, the Internet).
IP Port Numbers used: None
IPSEC Services
Service Name: PolicyAgent
Executable Name: lsass.exe
Log On As: LocalSystem
Description Provides end-to-end security between clients and servers on TCP/IP networks. Manages IP security (IPSEC) policy, starts the Internet Key Exchange (IKE) and coordinates IPSEC policy settings with the IP security driver. IP Port Numbers used:
TCP: 50 (ESP), 51 (AH)
UDP: 500 (ISAKMP)
Kerberos Key Distribution Center
Service Name: Kdc
Executable Name: lsass.exe
Log On As: LocalSystem
Description: Enables users to log on to the network using the Kerberos v5 authentication protocol.IP Port Numbers used:
TCP: 88, 544
UDP: 88, 464
License Logging
Service Name: LicenseService
Executable Name: llssrv.exe
Log On As: NetworkService
Description: Tracks Client Access License usage for server products, such as Internet Information Server (IIS), Terminal Services, File and Print services, as well as other products such as SQL Server and Microsoft Exchange Server.
IP Port Numbers used:
TCP: 135 (replication only)
Logical Disk Manager
Service Name: Dmserver
IP Port Numbers used: None
Logical Disk Manager Administrative Service
Service Name: Dmadmin
Executable Name: dmadmin.exe /com
Log On As: LocalSystem
Description: Performs administrative service for disk management requests.
IP Port Numbers used: None
Message Queuing
Service Name: Msmq
Executable Name: mqsvc.exe
Log On As: LocalSystem
Description: A messaging infrastructure and development tool for creating distributed messaging applications for Windows.
IP Port Numbers used:
TCP: 135, 1801, 2101 (Server listens), 2103, 2105
UDP: 3527 (MSMQ ping), 1801
Message Queuing Down Level Client Support
Service Name: MQDS
Executable Name: mqdssvc.exe
Log On As: LocalSystem
Description: Provides Active Directory access for Message Queuing clients (Windows 95, Windows 98, Windows NT 4.0, Windows 2000 and Windows Server 2003) on domain controllers. IP Port Numbers used: None
Message Queuing Triggers
Service Name: MSMQTriggers
Executable Name: mqtgsvc.exe
Log On As: LocalSystem
Description: Provides rule-based monitoring of messages arriving in a Messages Queuing queue and, when the conditions of a rule are satisfied, invokes a COM component or a stand-alone executable program to process the message. The MSMQ Triggers service is installed as an integral part of Message Queuing.
IP Port Numbers used: None
Messenger
Service Name: Messenger
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Transmits net send and alerter service messages between clients and servers.
Net Logon
Service Name: Netlogon
Executable Name: lsass.exe
Log On As: LocalSystem
Description: Maintains a secure channel between your computer and the domain controller for authenticating users and services.
IP Port Numbers used:
TCP: 139, 888
UDP: 137, 138
NetMeeting Remote Desktop Sharing
Service Name: Mnmsrvc
Executable Name: mnmsrvc.exe
Log On As: LocalSystem
Description: Allows authorized users to remotely access your Windows desktop from another PC over a corporate intranet by using Microsoft NetMeeting conferencing software.
IP Port Numbers used:
TCP: 215, 731, 3389
RDP: 3389
Network Connections
Service Name: Netman
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Manages objects in the Network Connections folder, in which you can view both network and remote connections.
IP Port Numbers used: None
Network DDE
Service Name: NetDDE
Executable Name: netdde.exe
Log On As: LocalSystem
Description: Provides network transport and security for DDE (dynamic data exchange) by applications running on the same computer or on different computers. IP Port Numbers used: None
Network DDE DSDM
Service Name: NetDDEdsdm
Executable Name: netdde.exe
Log On As: LocalSystem
Description: Manages shared DDE and is used by Network DDE.
IP Port Numbers used: None
Network Location Awareness (NLA)
Service Name: NLA
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Collects and stores network configuration information such as IP address and Domain name changes as well as location change information and notifies applications when this information changes.
IP Port Numbers used: None
Network News Transfer Protocol (NNTP)
Service Name: NNTPSVC
Executable Name: INETINFO.EXE
Log On As: LocalSystem
Description: NNTP is a member of the TCP/IP suite of protocols used to distribute network news messages to NNTP servers and clients (newsreaders) on the Internet.
IP Port Numbers used:
TCP: 119, 563 (SSL)
NT LM Security Support Provider
Service Name: NtLmSsp
Executable Name: lsass.exe
IP Port Numbers used: LSA users RPC/TCP and thus uses a port dynamically assigned by the RPC endpoint mapper.
Performance Logs and Alerts
Service Name: Sysmonlog
Executable Name: Smlogsvc.exe
Log On As: NetworkService
Description: Collects performance data from local or remote computers based on preconfigured schedule parameters, then writes the data to a log or triggers an alert. IP Port Numbers used:
TCP: 139
Plug and Play
Service Name: PlugPlay
Executable Name: Services.exe
Log On As: LocalSystem
Description: Enables a computer to recognize and adapt to hardware changes with little or no user input. IP Port Numbers used: None
Portable Media Serial Number
Service Name: WMDMPMSN WmdmPmSN
Executable Name: svchost.exe -k netsvcs
Logon On As: LocalSystem
Description: Retrieves the serial number of a portable music player connected to the computer.
IP Port Numbers used: None
Print Server for Macintosh
IP Port Numbers used:
TCP: 139, 515
UDP: 137, 138, 1709
Protected Storage
Service Name: ProtectedStorage
Executable Name: lsass.exe
Log On As: LocalSystem - Allow service to interact with desktop
Description: Provides protected storage for sensitive data, such as private keys, to prevent access by unauthorized services processes or users.
IP Port Numbers used: None
QoS RSVP
System Services for Windows Server 2003 Family and Windows XP Operating Systems Page 60 of 146
http://www.microsoft.com/technet/prodtechnol/windowsserver2003/technologies/manage... 5/18/2004
Service Name: RSVP
Executable Name: RSVP.EXE
Log On As: LocalSystem
Description: This service is started when an application uses the (Generic Quality of Service) GQoS API requesting a specific quality of service on the end-to-end connection it uses.
IP Port Numbers used: None
Remote Access Auto Connection Manager
Service Name: RasAuto
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Creates a connection to a remote network whenever a program references a remote DNS or NetBIOS name or address.
IP Port Numbers used: None
Remote Access Connection Manager
Service Name: RasMan
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Manages dial-up and virtual private networks (VPN) connections from your computer to the Internet or other remote networks.
IP Port Numbers used: None
Remote Administration Service
Service Name: SrvcSurg
Executable Name: Srvcsurg.exe
Log On As: LocalSystem
IP Port Numbers used:
TCP: 1067, 1068
Remote Procedure Call (RPC)
Service Name: RpcSs
Executable Name: svchost -k rpcss
Log On As: LocalSystem
Description: Microsoft RPC is a powerful, robust, efficient, and secure interprocess communication (IPC) mechanism that enables data exchange and invocation of functionality residing in a different process.IP Port Numbers used:
TCP: 135, 530, 593, 80 if RPC tunneling over HTTP is used, dynamically allocated
UDP: 135, 530, 2034, dynamically allocated
Remote Procedure Call (RPC) Locator
Service Name: RpcLocator
Executable Name: locator.exe
Log On As: NetworkService
Description: Enables RPC clients using the RpcNs* family of APIs to locate RPC servers and manages the RPC name service database. IP Port Numbers used:
TCP: 135
Remote Registry
Service Name: RemoteRegistry
Executable Name: svchost.exe -k regsvc
Log On As: LocalService
Description: Enables remote users to modify registry settings on your computer, provided the remote users have the required permissions.
IP Port Numbers used: None
Remote Server Manager
Service Name: AppMgr
Executable Name: APPMGR.EXE
Log On As: LocalSystem
Description: The Remote Server Manager Server provides the following functionality:
The Remote Server Manager acts as a WMI instance provider for Remote Administration Alert Objects and a WMI method provider for Remote Administration Tasks.
IP Port Numbers used: None
Remote Storage Server
Service Name: Remote_Storage_Server
Executable Name: RsServ.exe
Log On As: LocalSystem
Description: The Remote Storage Server service is a hierarchical storage management application that migrates data from upper-level storage to lower-level storage. IP Port Numbers used:
TCP: 135
Removable Storage
Service Name: NtmsSvc
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Manages removable media drives and libraries. This service maintains a catalog of identifying information for removable media used by a system, including tapes, CDs, and so on.
IP Port Numbers used: None
Resultant Set of Policy Provider
Service Name: RSoPProv
Executable Name: RSoPProv.exe
Log On As: LocalSystem
Description: Enables you to connect to a Windows domain controller, access the Windows Management Instrumentation (WMI) database for that computer, and simulate RSoP for Group Policy settings that would be applied to a user or computer located in Active Directory on a Windows 2000 or later domain.
IP Port Numbers used: None
Routing and Remote Access
Service Name: RemoteAccess
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: The Routing and Remote Access (RRAS) service provides multi-protocol LAN-to-LAN, LAN-to-WAN, virtual private network (VPN), and network address translation (NAT) routing services. IP Port Numbers used:
TCP: 47 (GRE) 1723
UDP: 500, 1701 (Layer 2 Tunneling) 1723 (PPTP)
SAP Agent
Service Name: Nwsapagent
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Advertises network services on an IPX network using the IPX SAP (Inter Packet eXchange) (Service Advertising Protocol) protocol.
IP Port Numbers used: None
Secondary Logon
Service Name: Seclogon
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: The Secondary Logon service allows the user to create processes in the context of different security principals.
IP Port Numbers used: None
Security Accounts Manager
Service Name: SamSs
Executable Name: lsass.exe
Log On As: LocalSystem
Description: The SAM (Security Accounts Manager) is a protected subsystem that manages user and group account information. IP Port Numbers used:
TCP: 139, 445
UDP: 137, 138, 139, 445
Shell Hardware Detection
Service Name: ShellHWDetection
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: This service provides notifications for AutoPlay hardware events.
IP Port Numbers used: None
Simple Mail Transfer Protocol (SMTP)
Service Name: SMTPSVC
Executable Name: inetinfo.exe
Log On As: LocalSystem
Description: Transports e-mail across the network.
IP Port Numbers used:
TCP: 25
Simple TCP/IP Services
Service Name: SimpTcp
Executable Name: tcpsvcs.exe
Log On As: NetworkService
Description: Implements support for the Echo, Discard, Character Generator, Daytime and Quote of the Day protocols.
IP Port Numbers used:
TCP: 7, 9, 13, 17, 19
UDP: 7, 9, 13, 17, 19
Single Instance Storage Groveler
Service Name: Groveler
Executable Name: grovel.exe
Log On As: LocalSystem
Description: The Single Instance Storage Groveler (SIS) service is an integral component of the Remote Installation Service (RIS).
IP Port Numbers used: None
Smart Card
Service Name: SCardSvr
Executable Name: SCardSvr.exe
Log On As: LocalService
Description: Manages and controls access to a smart card inserted into a smart card reader attached to the computer.
IP Port Numbers used: None
SNMP Service
Service Name: SNMP
Executable Name: snmp.exe
Log On As: LocalSystem
Description: Allows incoming SNMP (Simple Network Management Protocol) requests to be serviced by the local computer. IP Port Numbers used:
UDP: 161 (general SNMP messages)
SNMP Trap Service
Service Name: SNMPTRAP
Executable Name: snmptrap.exe
Log On As: LocalService
Description: Receives trap messages generated by local or remote SNMP agents and forwards the messages to SNMP management programs running on the computer.
IP Port numbers used:
UDP: 162
Special Administration Console Helper
Service Name: Sacsvr
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: You can use the Special Administration Console (!SAC) to perform remote management tasks if the Windows Server family operating system stops functioning due to a Stop error message.
IP Port Numbers used: None
SSDP Discovery Service
Service Name: SSDPRSRV
Executable Name: svchost.exe -k LocalService
Log On As: LocalService
Description: Enables discovery of UPnP devices (Universal Plug and Play) on a home network.
IP Port Numbers used:
UDP: 1900
IP Port Numbers used: None
System Restore Service
Service Name: Srservice
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: System Restore is a component of Windows XP Professional that you can use to restore your computer to a previous state.
IP Port Numbers used: None
TCP/IP NetBIOS Helper
Service Name: LMHosts
Executable Name: svchost.exe -k LocalService
Log On As: LocalService
Description: Provides support for NetBIOS over TCP/IP (NetBT) and NetBIOS name resolution for clients on your network; thus, enabling users to share files, print, and log on to the network. IP Port Numbers used:
TCP: 139 (session services)
UDP: 137 (name services), 138 (datagram services)
TCP/IP Print Server
Service Name: LPDSVC
Executable Name: tcpsvcs.exe
Log On As: LocalSystem
Description: Enables TCP/IP-based printing using the Line Printer Daemon protocol. IP Port Numbers used:
TCP: 515
Telephony
Service Name: TapiSrv
Description: Provides TAPI (Telephony API) support for programs that control telephony devices and IP-based voice connections on the local computer and through the LAN on servers that are also running the service.
IP Port Numbers used: None
Telnet
Service Name: TlntSvr
Executable Name: tlntsvr.exe
Log On As: LocalService*
Description: Telnet Server for Windows provides ASCII terminal sessions to Telnet clients.
IP Port Numbers used: None
Terminal Services
Service Name: TermService
Executable Name: svchost.exe -k termsvcs (svchost.exe –k netsvcs on Windows XP)
Log On As: LocalSystem
Description: Provides a multisession environment that allows client devices to access a virtual Windows desktop session and Windows-based programs running on the server. IP Port Numbers used:
TCP: 3389
RDP: 3389
Terminal Services Session Directory
Service Name: Tssdis
Executable Name: tssdis.exe
Log On As: LocalSystem
Description: This service provides a multisession environment that allows client devices to access a virtual Windows desktop session and Windows-based programs running on Windows Server.IP Port Numbers used:
UDP: 1083
Themes
Service Name: Themes
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides user experience theme management services.
IP Port Numbers used: None
Trivial FTP Daemon
Service Name: tftpd
Executable Name: tftpd.exe
Log On As: LocalSystem
IP Port Numbers used:
TCP: 69
UDP: 69
Uninterruptible Power Supply
Service Name: UPS
Executable Name: ups.exe
Log On As: LocalService
Description: Manages communications with an Uninterruptible Power Supply (UPS) connected to the computer by a serial port.
IP Port Numbers used: None
Universal Plug and Play Device Host
Service Name: UPNPHost
Executable Name: svchost.exe -k upnphost
Log On As: LocalService
Description: Provides support to host Universal Plug and Play devices.
IP Port Numbers used:
TCP: 2869. 5000 (for event notifications)
Upload Manager
Service Name: Uploadmgr
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: The Upload Manager service manages the synchronous and asynchronous file transfers IP Port Numbers used:
TCP: 80
Virtual Disk Service
Service Name: VDS
Executable Name: VDS.EXE
Log On As: LocalSystem
Description: The Virtual Disk Service, or VDS, provides a single interface for managing block storage virtualization whether done in OS software, RAID storage hardware subsystems, or other virtualization engines.
IP Port Numbers used: None
Volume Shadow Copy
Service Name: VSS
Executable Name: vssvc.exe
Log On As: LocalSystem
Description: Manages volume snapshots used by backup applications.
IP Port Numbers used: None
WebClient
Service Name: WebClient
Executable Name: svchost.exe -k LocalService
Log On As: LocalService
Description: The WebClient service allows Win32 applications to access documents on the Internet.
IP Port Numbers used:
TCP: 80
Web Element Manager
Service Name: Elementmgr
Executable Name: Elementmgr.exe
Log On As: LocalSystem
Description: The Web Element Manager Service is responsible for serving Web user interface elements for the Administration Web site at port 8098. IP Port Numbers used:
TCP: 8098
Windows Audio
Service Name: Audiosrv
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides support for sound and related Windows Audio event functions.
IP Port Numbers used: None
Windows Installer
Service Name: MsiServer
Executable Name: msiexec.exe /V
Log On As: LocalSystem
Description: Windows Installer manages the installation and removal of applications by applying a set of centrally defined setup rules during the installation process. IP Port Numbers used:
TCP: 80
Windows Internet Name Service (WINS)
Service Name: WINS
Executable Name: wins.exe
Log On As: LocalSystem
Description: Enables NetBIOS name resolution. IP Port numbers used:
TCP: 42 (Replication), 135 (WINS MANAGER), 137 (WINS Registration), 1101
UDP: 445, 1100, 1512
Windows Management Instrumentation
Service Name: Winmgmt
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: Provides system management information.
IP Port Numbers used: None
Windows Media Services
Service Name: WMServer
Executable Name: WMServer.exe
Log On As: NetworkService
Description: Provides streaming media services over IP-based networks.
IP Port Numbers used:
TCP: 1755 (MMS), 554 (RSTP), 80 (HTTP), 135 (DCOM, WMI)
UDP: 161 (SNMP), 1755 (MMS), 135 (DCOM, WMI)
Windows System Resource Manager
Service Name: WindowsSystemResourceManager
Executable Name: Wrm.exe
Log On As: LocalSystem
Description: The Windows System Resource Manager (WSRM) service is a tool to help customers deploy applications into consolidation scenarios.
IP Port Numbers used: None
Windows Time
Service Name: W32Time
Executable Name: svchost.exe -k netsvcs
Log On As: LocalSystem
Description: The Windows Time service maintains date and time synchronization on all computers running on a Microsoft Windows network.
IP Port Numbers used:
TCP: 123 (NTP port)
WinHTTP Web Proxy Auto-Discovery Service
Service Name: WinHttpAutoSvc
Executable Name: SVCHOST.EXE –k LocalService
Log On As: LocalService
Description: The WinHttpAutoSvc implements proxy configuration discovery for WinHttp clients. IP Port Numbers used: None
WMI Performance Adapter
Service Name: WmiApSrv
Executable Name: wmiapsrv.exe
Log On As: LocalSystem
Description: Provides performance library information from WMI HiPerf providers.
IP Port Numbers used: None
World Wide Web Publishing Service
Service Name: W3SVC
Executable Name: svchost.exe –k iissvcs
Log On As: LocalSystem
Description: This service provides HTTP services for applications on the Windows platform. IP Port Numbers used:
TCP: 80, 443
UDP: 80, 443
Operating System Service ports WIndows PortsOperating System Service ports WIndows Ports
No Comments »
Filed under: Operating System
