I just ran an nmap scan against our network, and many Windows 7 machines have several high ports listening with Microsoft Windows RPC. Example:
Port Serv Process name 49152, msrpc [wininit.exe] 49153, msrpc [svchost.exe, Eventlog] 49154, msrpc [svchost.exe, Schedule] 49155, msrpc [lsass.exe] 49157, msrpc [services.exe] 49159, msrpc [svchost.exe, PolicyAgent]
For security reasons, I would like to close any listening service that is not needed, or at least block the ports in question using the Windows FW.
I realize that the processes above are system processes that I cannot close, but perhaps there is some configuration that can be done to prevent them from listening?
Lastly, not sure if relevant, but we do not use any domains or Active Directory - only a workgroups against a Samba server.
So, my questions are:
- What are the listening services needed for in general?
- In my scenario, can I disable them somehow (=make them not listen)?
- If #2 is not doable, can I safely block them with the FW?