Back Room Net (backroomnet) tcp/3387 - What is it and how can it be shut down?

Question

Netstat showing tcp/3387 listening with PID as 4:

Task Manager showing PID 4 as System:

The only info I can find on this port ties back to "Back Room Net" but I'm not sure what this is or what it's used for? Does anyone have any MS articles about any services or what can be done to shut this down?

Answer 1

I had to run down the Server Roles and Features to start removing those to finally figure out it was tied to the Remote Desktop Session Host feature. If anyone wants to remove this in the future, here's how:

Server Manager > Manage > Remove Roles and Features, Next, Next
Expand 'Remote Desktop Services'
Uncheck 'Remote Desktop Session Host', Next, Next, Remove
Reboot

Answer 2

Run these 2 commands from an admin prompt.

netsh http show servicestate view=requestq > %temp%\netsh.txt
notepad  %temp%\netsh.txt

Search for the port number. It should show up in Registered URLs:. Then take the Process Id and plug it into these Powershell commands. (Run it in Powershell_ise.)

$p = 4960         # the process id
$s = Get-CimInstance win32_service -FIlter "ProcessId=$p"
Get-Service -Name $s.name | Format-Table -AutoSize    
Get-Process -Id $p -IncludeUserName| Format-List -Property Path, company, Description, Username

I was curious about port 5357.

C:\Temp>netstat -aon | findstr -i listen | findstr 5357
TCP 0.0.0.0:5357 0.0.0.0:0 LISTENING 4
TCP [::]:5357 [::]:0 LISTENING 4

Request queue name: Request queue is unnamed.
Version: 2.0
State: Active
Request queue 503 verbosity level: Basic
Max requests: 1000
Number of active processes attached: 1
Process IDs:
4960
URL groups:
URL group ID: FA00000040000001
State: Active
Request queue name: Request queue is unnamed.
Properties:
Max bandwidth: inherited
Max connections: inherited
Timeouts:
Timeout values inherited
Number of registered URLs: 1
Registered URLs:
HTTP://*:5357/6D384FFD-4484-4F56-A1B7-8E94A74BA63F/

PS C:\Temp> $p = 4960 # the process id
$s = Get-CimInstance win32_service -FIlter "ProcessId=$p"
Get-Service -Name $s.name | Format-Table -AutoSize
Get-Process -Id $p -IncludeUserName| Format-List -Property Path, company, Description, Username

Status Name DisplayName

---

Running FDResPub Function Discovery Resource Publication

Path : C:\WINDOWS\system32\svchost.exe
Company : Microsoft Corporation
Description : Host Process for Windows Services
UserName : NT AUTHORITY\LOCAL SERVICE

Answer 3

Might also try from a clean boot.
https://support.microsoft.com/en-us/help/929135/how-to-perform-a-clean-boot-in-windows

--please don't forget to Accept as answer if the reply is helpful--

Answer 4

Hi ,

Agree with Dave, please try a clean boot to see if port 3387 is still listening. If not, please check if you install any third-party application on your server.

Best Regards,

Candy

--------------------------------------------------------------

If the Answer is helpful, please click "Accept Answer" and upvote it.

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.