Reservation for namespace identified by URL prefix http://*:25000/ was successfully added

Question

My server reports a lot of ports with listening going on. Running "netsh http show urlacl" from a command prompt gives me entries like the ones shown below. I'm wondering if I can tell what programs are setting up these reservations and could they be dangerous or indicative of a compromised server.

Reserved URL : http://*:22090/

    User: \Everyone

        Listen: Yes

        Delegate: Yes

        SDDL: D:(A;;GA;;;WD)

Reserved URL            : http://*:22091/

    User: \Everyone

        Listen: Yes

        Delegate: Yes

        SDDL: D:(A;;GA;;;WD)

Reserved URL            : http://*:25000/

    User: \Everyone

        Listen: Yes

        Delegate: Yes

        SDDL: D:(A;;GA;;;WD)

Answer 1

Hello @R. Campbell
The entries returned by netsh http show urlacl are HTTP.sys URL reservations, not necessarily indicators that an application is actively listening on those ports. A URL reservation simply grants a user or service permission to bind to a specific HTTP namespace.

By themselves, entries such as:

http://:22090/*

http://:22091/*

http://:25000/*

are not evidence of a compromised server. Many Microsoft components and third-party applications create URL ACLs during installation and may leave them in place even when the application is not currently running.

To identify what is actually using those ports, you can:

1. Check for listening processes:

netstat -ano | findstr :25000

Then map the PID to a process:

tasklist /FI "PID eq <PID>"

2. Use PowerShell:

Get-NetTCPConnection -LocalPort 25000 | Select-Object LocalAddress,LocalPort,OwningProcess

Get-Process -Id <PID>

3. Review the HTTP service state:

netsh http show servicestate

This command shows the registered URL groups and the owning process, which is often more useful than show urlacl for determining which application is actively using an HTTP.sys listener.

If there is no process listening on the port, the URL reservation is generally harmless. If there is a process, verify that it corresponds to an expected Windows component or installed application.

If you can share the Windows Server version and whether these ports appeared after installing a particular role or application (such as IIS, WinRM, WCF, SQL Server Reporting Services, or another service), it may be possible to identify the component that created the URL reservations.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.