Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am running IIS 7 on a windows 2008 R2 machine and have found that stopping IIS does not prevent it accepting connections.

Stopping IIS won't even kill an active telnet session on port 80. The server continues to show 404 pages.

Am I missing something simple? My use case is that I need to block port 80 for a load balancer to take my server out of the pool

share|improve this question
up vote 1 down vote accepted

Does netstat show what is using the port?

I'd also try the sysinternals tools like procmon and process explorer to narrow down what could be causing the port to be held open (and tcpview)

share|improve this answer
Netstat did not show the process that was using it. Eventually I used feedback on a related windows 7 question to figure out that it was System and the process activation service. Thanks for the help Bart. – jhappoldt Jun 24 '11 at 20:40

That's not typical behavior. You must have a proxy or something in front of IIS. Test to see if you get error 404 in IE ON the server browsing itself. If you don't, what does the network between your web browser PC and the IIS server look like? If you do get error 404 on the server itself with IE browsing the IIS site, some other program is listening on port 80.

Error 404 is an HTTP error generated by an HTTP server. Something that understands HTTP is responding to your request on port 80 and constructing an error 404 message and delivering it to the web browser via the HTTP protocol.

Are you sure you are stopping IIS and not just stopping one of the virtual sites in IIS?

share|improve this answer
IIS was stopped but the process activation service was the culprit. – jhappoldt Jun 24 '11 at 20:37

You're missing something simple.

LoadBalancerCapabilities determines the behaviour of HTTP.SYS when an Application Pool is stopped.

Default is an HTTP 503; if your LB only understands TCP and not HTTP error codes, setting the above to TCP Resets should do the trick.

Stopping WAS is not typically necessary to remove a node from an LB cluster, but that depends on LB capabilities.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.