Winnit Ports 6400 on Exchange server

Question

Winnit Ports 6400 on Exchange server

KennethSalcedo-4188 0

I have run an external scan on my environment and we find that port 6400 is listening on our exchange server for the wininit process is this a normal operation / process

Anonymous

2025-05-08T03:42:41.0633333+00:00

Hi Kenneth Salcedo,

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back. If you think my reply is helpful to you, please remember to mark it as an answer. Warm thanks.
Anonymous

2025-05-12T03:01:38.96+00:00

Hi Kenneth Salcedo,

Is there any update on this thread? If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.
KennethSalcedo-4188 0 Reputation points

2025-05-13T12:43:59.9566667+00:00

We understand what Winnit does there is just little documentation stating that winnit.exe uses a open listening port for its processes.
Anonymous

2025-05-14T07:14:01.23+00:00

Hi Kenneth Salcedo,

Please also check the link provided in the Answer to confirm if that "wininit.exe" listening port 6400 is genuine.

Additionally, you can use Wireshark or Network monitor or other network monitor tool to monitor traffic on port 6400 for suspicious activity (e.g., connections to unknown Ips).

Please also run a system full scan with Microsoft Defender or other trusted anti-malware software to confirm if any other suspicious files on your server.

1 answer

Your answer

Anonymous

2025-05-08T03:42:41.0633333+00:00

Hi Kenneth Salcedo,

Just checking in to see if below information was helpful. If you have any further updates on this issue, please feel free to post back. If you think my reply is helpful to you, please remember to mark it as an answer. Warm thanks.
Anonymous

2025-05-12T03:01:38.96+00:00

Hi Kenneth Salcedo,

Is there any update on this thread? If the issue has been resolved, please mark the helpful replies as answers, this will make answer searching in the forum easier and be beneficial to other community members as well. Thanks for your understanding.
KennethSalcedo-4188 0 Reputation points

2025-05-13T12:43:59.9566667+00:00

We understand what Winnit does there is just little documentation stating that winnit.exe uses a open listening port for its processes.
Anonymous

2025-05-14T07:14:01.23+00:00

Hi Kenneth Salcedo,

Please also check the link provided in the Answer to confirm if that "wininit.exe" listening port 6400 is genuine.

Additionally, you can use Wireshark or Network monitor or other network monitor tool to monitor traffic on port 6400 for suspicious activity (e.g., connections to unknown Ips).

Please also run a system full scan with Microsoft Defender or other trusted anti-malware software to confirm if any other suspicious files on your server.

Answer 1

Hi Kenneth Salcedo,

Thank you for posting your question in the Microsoft Q&A forum.

Based on my research, Microsoft's genuine "wininit.exe" should reside in "C:\Windows\System32". It is a critical system process, an essential Windows file and not to be removed.

You could check suggestions in the following link to confirm if that "wininit.exe" listening port 6400 is genuine:

The process wininit.exe (127.0.0.1) has initiated the restart of computer - Microsoft Q&A

Additionally, please understand that our “Exchange Server Management” tag mainly focus on issues related to managing and using Exchange server features and daily work. Wininit.exe related issues are more relevant to windows server side, if you need further assistance for Wininit process, you can post questions under “Windows server” related tags.

Thanks for your understanding.

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

Share via

Winnit Ports 6400 on Exchange server

1 answer

Your answer