Find what's using a port on Windows

Published October 13, 2026. Steps are for Windows 11 and 10.

Find the process

In PowerShell, replace 3000 with your port:

Get-NetTCPConnection -LocalPort 3000 -State Listen |
  Select-Object LocalAddress, OwningProcess
Get-Process -Id <OwningProcess>

Or in Command Prompt, where the last column is the process ID:

netstat -ano | findstr :3000
tasklist /FI "PID eq <PID>"

Stop it

Stop-Process -Id <PID>

Or taskkill /PID <PID> /F in Command Prompt. Usually it's a dev server left running after its terminal closed, often node.exe or python.exe.

When the owner looks strange

• wslrelay.exe or com.docker.backend.exe: the port belongs to something running inside WSL or a Docker container. Stop it there (docker ps, then docker stop).
• System (PID 4): a Windows service such as IIS is using it.
• Nothing is listening but you still get “access denied”: Hyper-V, WSL or Docker reserved a range of ports. List them with netsh interface ipv4 show excludedportrange protocol=tcp and pick a port outside those ranges.

Is it reachable from your network?

Check the LocalAddress. 127.0.0.1 or ::1 means only your PC can connect. 0.0.0.0 or :: means other devices on your network can reach it too, which you may not want on public Wi-Fi.

More fixes

• Vmmem using too much memory
• Antimalware Service Executable using high CPU
• Windows Modules Installer Worker using high CPU
• Windows Search indexer using high CPU or disk
• What's taking up space on your C: drive