I am running a Windows Server 2012 R2. At the moment, I want to improve the security of my server, so I am looking for services (and open ports), that are not needed.
I disabled nearly every server role, except IIS (I need the IIS).
The windows firewall is configured so that every inbound/outbound connection without a rule, is automatically blocked.
I have created only some rules for port 80,443 and the remote-desktop-port. All other rules are deactivated (or set to private profile), hence there are no rules for other ports/protocols/services on my public network, and therefore, there shouldn't exist open ports.
But if I scan my server with nmap (tcp connect scan), there are some open ports. For example:
25/tcp open smtp
80/tcp open http
110/tcp open pop3
119/tcp open nntp
143/tcp open imap
465/tcp open smtps
563/tcp open snews
587/tcp open submission
993/tcp open imaps
995/tcp open pop3s
3389/tcp open rdp
I do not need pop,imap and the other services (except RDP 3389).
Now I have some questions: 1. How could it be possible that the ports are shown as open, if the firewall should block all ports wihtout rules (the ports above have no rules)? 2. With netstat -anop tcp I looked up which services are listening on this ports. It is the system-service. But why is the system-service listening on this ports and how could I stop the service from doing so?