What's running on that port?

At times we may run an internal or external scan on your server and we finds that there is port xxxxx open. You are not aware of that port or any application that is using that port. Well weird...? How to find what's running on that port.

The first though to do telnet
telnet IP_Address portno
you get a blank screen... now what next, it doesn't give any clue what is running on that port, which service which process etc.

So here are some cool tips to quickly find out what is running on unknown port, lets say 32456.
Step 1: Fireup the command prompt
Step 2: netstat -ano | findstr /i "listening"
TCP    0.0.0.0:32456            0.0.0.0:0              LISTENING       1100
TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       888
TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
TCP    0.0.0.0:4105           0.0.0.0:0              LISTENING       424
TCP    0.0.0.0:4728           0.0.0.0:0              LISTENING       424

Look for your port in the result and identify the PID,. The PID is listed at extreme right hand side.

Step 3: tasklist /svc /fi "PID eq 1100"

Image Name                     PID Services
========================= ======== ==========================

==================
svchost.exe                   1100 Appinfo, AppMgmt, BITS, Browser,
                                   gpsvc, IKEEXT, iphlpsvc, LanmanServer,
                                   ProfSvc, Schedule, ShellHWDetection,
                                   Themes, Winmgmt, wuauserv

Image Name is basically your process in taskmanager

Now you have the names of the services running under the svchost.exe, you can use google to perform quick search what services are for.

Hope that would be helpful.

Regards,
Navdeep [v-2nas]

Windows cann't verify that user name is unique

Hi All,

While create a user in another domain tree of same forest. I came accross the following warning message.

Although the server is DC and GC as well the reason for this error is due to that name resolution to forest root dc or other dc was failing due to which the this warning is generate although user will be create it won't be able to logon using other DC.

In order to resolve this you can either create conditional forwards or stub zone to parent root or other domains which have gc present.  You need to keep this in mind when you create stub zone and save it to all dns servers in Active Directory domain x (your domain) then it has be done using Enterprise Admin Account otherwise DNS Application partition will not be created alternatively if you are only using AD intergrated DNS you can save this on all DC in active directory domain x.