I am running IIS 7 on a windows 2008 R2 machine and have found that stopping IIS does not prevent it accepting connections.

Stopping IIS won't even kill an active telnet session on port 80. The server continues to show 404 pages.

Am I missing something simple? My use case is that I need to block port 80 for a load balancer to take my server out of the pool

3 Answers 3


Does netstat show what is using the port?

I'd also try the sysinternals tools like procmon and process explorer to narrow down what could be causing the port to be held open (and tcpview)

  • Netstat did not show the process that was using it. Eventually I used feedback on a related windows 7 question to figure out that it was System and the process activation service. Thanks for the help Bart.
    – jhappoldt
    Jun 24, 2011 at 20:40

That's not typical behavior. You must have a proxy or something in front of IIS. Test to see if you get error 404 in IE ON the server browsing itself. If you don't, what does the network between your web browser PC and the IIS server look like? If you do get error 404 on the server itself with IE browsing the IIS site, some other program is listening on port 80.

Error 404 is an HTTP error generated by an HTTP server. Something that understands HTTP is responding to your request on port 80 and constructing an error 404 message and delivering it to the web browser via the HTTP protocol.

Are you sure you are stopping IIS and not just stopping one of the virtual sites in IIS?

  • IIS was stopped but the process activation service was the culprit.
    – jhappoldt
    Jun 24, 2011 at 20:37
  • @jhappoldt can you share more on what process activation service was doing that was undesired? Oct 18, 2018 at 5:44
  • @AnirudhGoel I cant. It's been over 7 years since I did this.
    – jhappoldt
    Oct 19, 2018 at 20:59

You're missing something simple.

LoadBalancerCapabilities determines the behaviour of HTTP.SYS when an Application Pool is stopped.

Default is an HTTP 503; if your LB only understands TCP and not HTTP error codes, setting the above to TCP Resets should do the trick.

Stopping WAS is not typically necessary to remove a node from an LB cluster, but that depends on LB capabilities.


  • if iis is stopped and loadbalancercapabiltiies are already set at HttpLevel, shouldn't the reponse in this case be a 503 instead of 404? Given the OP saw 404 in the response doesn't it mean it is failing else where? Oct 18, 2018 at 5:49
  • Yep, I addressed the intent rather than diagnosing the symptoms.
    – TristanK
    Nov 7, 2018 at 3:22

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .