Determine which application is using a particular port

Say you try to install an application which needs to use port 80. But during or after the installation, the application is not able to launch because port 80 is already in use, how do you determine which application is holding on to port 80?

In Windows, it is simple and fairly straight forward.

Follow the steps below:

1. Issue the following command to check which process is using port 80:

netstat -aon | findstr 0.0:80

NOTE: If you wanted to check for any other port number, replace the "80" in the command above with the port number of choice.2. The output could look like this:

TCP 0.0.0.0:80 0.0.0.0:0 LISTENING 2920

For the example above, referring to the number highlighted in yellow, this is the process id which is using/listening to port 80. The process id is assigned by the OS to an application/service which is running (it could be running in the background)

3. Issue the following command to get the name of the process which as the process id (as shown in the yellow text above - this value can be any number as assigned by the system, i.e. never fixed)

tasklist | findstr 2920

4. This command would yield an output which would have the following format:

httpd.exe 2920 Console 0 12,724 K

Based on the example above, the application using process id 2920 is "httpd.exe".

So, from here, you can see that port 80 is being used by process id 2920, where process id 2920 was assigned by the OS to httpd.exe which is running in the background (NOTE: this is on my system - If I was to restart my PC or stop httpd.exe and restart it, the process id would highly likely not be the same)

List of some rundll32 commands

Here is a list of some common and useful Windows rundll32 commands.

Add/Remove Programs
RunDll32.exe shell32.dll,Control_RunDLL appwiz.cpl,,0

Content Advisor
RunDll32.exe msrating.dll,RatingSetupUI

Control Panel
RunDll32.exe shell32.dll,Control_RunDLL

Delete Temporary Internet Files:
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 8

Delete Cookies:
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 2

Delete History:
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 1

Delete Form Data:
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 16

Delete Passwords:
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 32

Delete All:
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 255

Delete All + files and settings stored by Add-ons:
RunDll32.exe InetCpl.cpl,ClearMyTracksByProcess 4351

Date and Time Properties
RunDll32.exe shell32.dll,Control_RunDLL timedate.cpl

Display Settings
RunDll32.exe shell32.dll,Control_RunDLL access.cpl,,3

Device Manager
RunDll32.exe devmgr.dll DeviceManager_Execute

Folder Options - General
RunDll32.exe shell32.dll,Options_RunDLL 0

Folder Options - File Types
RunDll32.exe shell32.dll,Control_Options 2

Folder Options - Search
RunDll32.exe shell32.dll,Options_RunDLL 2

Folder Options - View
RunDll32.exe shell32.dll,Options_RunDLL 7

Forgotten Password Wizard
RunDll32.exe keymgr.dll,PRShowSaveWizardExW

Hibernate
RunDll32.exe powrprof.dll,SetSuspendState

Internet Explorer’s Internet Properties dialog box.
Rundll32 Shell32.dll,Control_RunDLL Inetcpl.cpl,,6

Keyboard Properties
RunDll32.exe shell32.dll,Control_RunDLL main.cpl @1

Lock Screen
RunDll32.exe user32.dll,LockWorkStation

Mouse Button - Swap left button to function as right
Rundll32 User32.dll,SwapMouseButton

Mouse Properties Dialog Box
Rundll32 Shell32.dll,Control_RunDLL main.cpl @0,0

Map Network Drive Wizard
Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL Connect

Network Connections
RunDll32.exe shell32.dll,Control_RunDLL ncpa.cpl

Organize IE Favourites
Rundll32.exe shdocvw.dll,DoOrganizeFavDlg

Open With Dialog Box
Rundll32 Shell32.dll,OpenAs_RunDLL Any_File-name.ext

Printer User Interface
Rundll32 Printui.dll,PrintUIEntry /?

Printer Management Folder.
Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL PrintersFolder

Power Options
RunDll32.exe Shell32.dll,Control_RunDLL powercfg.cpl

Process Idle Tasks
rundll32.exe advapi32.dll,ProcessIdleTasks

Regional and Language Options
Rundll32 Shell32.dll,Control_RunDLL Intl.cpl,,0

Stored Usernames and Passwords
RunDll32.exe keymgr.dll,KRShowKeyMgr

Safely Remove Hardware Dialog Box
Rundll32 Shell32.dll,Control_RunDLL HotPlug.dll

Sound Properties Dialog Box
Rundll32 Shell32.dll,Control_RunDLL Mmsys.cpl,,0

System Properties Box
Rundll32 Shell32.dll,Control_RunDLL Sysdm.cpl,,3

System Properties - Advanced
RunDll32.exe shell32.dll,Control_RunDLL sysdm.cpl,,4

System Properties: Automatic Updates
RunDll32.exe shell32.dll,Control_RunDLL sysdm.cpl,,5

Taskbar Properties
RunDll32.exe shell32.dll,Options_RunDLL 1

User Accounts
RunDll32.exe shell32.dll,Control_RunDLL nusrmgr.cpl

Unplug/Eject Hardware
RunDll32.exe shell32.dll,Control_RunDLL hotplug.dll

Windows Security Center
RunDll32.exe shell32.dll,Control_RunDLL wscui.cpl

Windows - About
RunDll32.exe SHELL32.DLL,ShellAboutW

Windows Fonts Installation Folder
Rundll32 Shell32.dll,SHHelpShortcuts_RunDLL FontsFolder

Windows Firewall
RunDll32.exe shell32.dll,Control_RunDLL firewall.cpl

Wireless Network Setup
RunDll32.exe shell32.dll,Control_RunDLL NetSetup.cpl,@0,WNSW

Managing stored passwords in Windows

When using IE and accessing pages on the internet through a proxy or opening password protected pages, an authentication window would pop up, requesting for a username and password, along with a "Remember my password" check box.

If you do tick the "Remember my password" box, this will end up saving the password on the computer and it will be remembered "forever", unless you manage to manually clear it somehow.

There is a way in which you would be able to view/manage all the passwords that have been stored on the local machine, you would need to issue the following command at a command prompt or on the "Start" -> "Run..." window:

rundll32.exe keymgr.dll,KRShowKeyMgr

View and manage saved Windows usernames/passwords

Enter the following command:
rundll32.exe keymgr.dll, KRShowKeyMgr --- note the "KRShowKeyMgr" is case sensitive.

The window which pops up shows all connections which have saved usernames/passwords.

The alternate method of accessing this window is by opening the following
Control Panel -> User Account -> Advanced tab -> Manage Passwords

Vista's Windows Update 8000FFFF error resolution

In Windows Vista, there could be an error thrown up while trying to run Windows Update.

To resolve Windows Update error 8000FFFF, try the following steps:
1. Launch REGEDIT
2. Go into HKLM\COMPONENTS, and check if these three values exist under the COMPONENTS key:
PendingXmldentifier
NextQueueEntryIndex
AdvancedInstallersNeedResolving
3) Providing they do exist, back up the Components key, then delete the three above values.
4) Restart the computer, and Windows Update should now be working fine.

Accessing the console session (session ID 0) using Remote Desktop

1. Open the Group Policy snap-in (Gpedit.msc).
2. In the left pane, under the Computer Configuration branch, expand the Administrative Templates branch.
3. Expand the Windows Components branch.
4. Click the Terminal Services folder.
5. In the right pane, double-click "Sets rules for remote control of Terminal Services user sessions".
6. On the Setting tab, click Enabled.
7. In the Options box, click Full Control with users' permission, and then click OK

Another way to open the console session (session ID 0) is to issue the command:
mstsc /v:<server name or IP address> /admin /console