If you try netstat -abn | more
you will not get a process name.
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING
Can not obtain ownership information
netstat -aon | find "TCP" | find ":80" showed me Process ID 4 which means SYSTEM. wtf?
Outputs:
TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 4
TCP 0.0.0.0:8080 0.0.0.0:0 LISTENING 4836
TCP 10.214.164.247:1076 140.206.78.8:80 ESTABLISHED 3440
TCP 10.214.164.247:1099 36.110.231.46:80 ESTABLISHED 3424
TCP 10.214.164.247:1143 140.206.78.18:80 ESTABLISHED 4300
TCP 10.214.164.247:1273 140.206.78.20:80 ESTABLISHED 5252
TCP 10.214.164.247:1310 223.167.166.61:80 ESTABLISHED 3440
TCP 10.214.164.247:1331 223.167.166.56:80 ESTABLISHED 4300
TCP 10.214.164.247:1359 54.243.113.215:80 ESTABLISHED 3432
TCP 10.214.164.247:1362 54.243.113.215:80 ESTABLISHED 3432
TCP [::]:80 [::]:0 LISTENING 4
Next try:
Device Manager –> Menu View –> Show hidden Devices
Open Non-Plug and Play Drivers, select HTTP and open the properties. If you try to stop the driver you will be shown a list of other services depending on HTTP which would also be stopped - not good…
After some googling I found the solution:
netsh http add iplisten ipaddress=::
This works instantly and I did not recognize any side effects yet.
Thanks
http://stichl.at/2012/11/port-80-in-use-on-windows-server-2008-r2/