# How to Kill a Process Using a Port in Windows

> Find what is holding port 3000, 8080 or any other port on Windows with netstat -ano, then end it with taskkill — plus the PowerShell one-liner equivalent.

- Source: https://zepe.online/guides/kill-process-using-port-windows
- Author: Robert Moca (https://zepe.online/author/robert-moca)
- Topic: Command line
- Published: 2026-08-06T09:00:00+00:00
- Updated: 2026-08-20T09:00:00+00:00
- Author: Zepe editorial team (https://zepe.online/editorial-standards)
- Image: https://zepe.online/img/kill-process-using-port-windows-featured-9f09875db1.webp

## The short answer

Run `netstat -ano | findstr :3000` to find the process ID holding the port — it is the last number on the line. Then run `taskkill /F /PID 1234`. In PowerShell, `Stop-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess -Force`.

## Key takeaways

- netstat's -o switch is the important one: without it you see the port but not which process owns it.
- The PID is the last column, and it is what taskkill needs, not the port number.
- "Address already in use" after a crashed dev server is usually an orphaned child process, not the terminal you closed.
- A port below 1024, or one held by a system process, needs an elevated prompt to release.

You start a development server and it refuses to come up: `EADDRINUSE: address already in use :::3000`. Something is sitting on the port. Nine times out of ten it is a previous run of the very same thing that never shut down properly, because closing a terminal window kills the shell but a detached child process carries on listening quite happily without it.

The fix is two commands: find the owner, then end it.

## Step one: find what is holding the port

### Identify the process using a port

1. Open Command Prompt.
   Win + R, `cmd`, Enter. Elevation is not needed to look, only to kill something you do not own; see [opening a terminal in Windows](https://zepe.online/guides/open-terminal-windows).
2. Run `netstat -ano | findstr :3000`, substituting your port number.
   `-a` shows all connections, `-n` shows numeric addresses rather than resolving names, `-o` adds the owning process ID. The `-o` is the one that matters.
3. Read the last number on each line. That is the PID.
   Look for the line whose state is **LISTENING** — that is the server holding the port. Lines in TIME_WAIT are closed connections lingering and will clear on their own.
4. Optionally, confirm what it is: `tasklist /FI "PID eq 1234"`.
   Worth doing before you kill it. A port you assumed was your dev server is occasionally something else entirely.

**Reading netstat -ano output**

| Column | Example | What it means |
| --- | --- | --- |
| Proto | `TCP` | Protocol — TCP or UDP |
| Local Address | `0.0.0.0:3000` | The port being held; 0.0.0.0 means all interfaces |
| Foreign Address | `0.0.0.0:0` | The remote end; zeros mean nothing is connected |
| State | `LISTENING` | LISTENING is the server. TIME_WAIT clears itself |
| PID | `14820` | The number taskkill needs |

> **Key point — Colon before the port number**
>
> Write `findstr :3000`, not `findstr 3000`. Without the colon you also match PID 3000, port 13000, port 30001 and any address containing those digits, which is how people end up killing the wrong process.

## Step two: end it

Run `taskkill /F /PID 14820`, substituting the number you just found. The `/F` forces it; without that flag, a process that is ignoring the polite request will carry on ignoring you.

You should see `SUCCESS: The process with PID 14820 has been terminated.` If you get `Access is denied`, reopen the prompt as administrator. If you get `The process ... not found`, it has already exited and the port is free.

## The PowerShell one-liner

If you are in PowerShell there is a purpose-built cmdlet that collapses the whole thing into one line, and it is the version worth memorising:

1. `Get-NetTCPConnection -LocalPort 3000` — shows the connection with an **OwningProcess** column.
2. `Get-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess` — names the process before you kill it.
3. `Stop-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess -Force` — finds and ends it in one line.

If the port is genuinely free, `Get-NetTCPConnection` throws a "No matching MSFT_NetTCPConnection objects found" error rather than returning nothing. That is a confusing way to say the port is available, but it is what it means.

**Figure: From port number to terminated process**

The confirmation step is worth the extra three seconds. Killing the wrong PID because of a partial number match is the usual way this goes wrong.

- **netstat -ano | findstr :3000** — List everything touching that port, with owning PIDs
- **Read the LISTENING line** — Last column is the PID; ignore TIME_WAIT entries
- **tasklist /FI "PID eq 14820"** — Confirm it is what you think before ending it
- **taskkill /F /PID 14820** — Expect SUCCESS; Access is denied means you need elevation

## Ports that come up repeatedly

**Commonly contested ports and what usually holds them**

| Port | Usually | Note |
| --- | --- | --- |
| 3000 | Node, React, Rails dev servers | The classic orphaned-process case |
| 8080 | Tomcat, proxies, alternative HTTP | Often a Java process that outlived its IDE |
| 5432 | PostgreSQL | A running service — stop the service, do not kill it |
| 3306 | MySQL / MariaDB | As above |
| 80 / 443 | IIS, or the World Wide Web Publishing Service | Needs elevation; stopping the service is cleaner |
| 5000 | Flask, ASP.NET, and macOS AirPlay habits | On Windows, usually a dev server |

> **Careful — If it is a service, stop the service**
>
> Killing the process behind a Windows service is a poor way to stop it — the Service Control Manager may restart it immediately, and databases in particular can be left with an unclean shutdown. Use `net stop postgresql-x64-15` or the Services console instead.

## When the port will not free up

- **The line says TIME_WAIT, not LISTENING.** Nothing is holding the port; the operating system is waiting out the TCP close sequence. It clears in under a couple of minutes on its own. There is no process to kill.
- **taskkill reports success but the port stays busy.** The process is stuck in a kernel-mode wait and cannot finish exiting. The [force quit guide](https://zepe.online/guides/force-quit-app-windows) covers why, and why only a restart resolves it.
- **Hyper-V has reserved the port range.** Run `netsh interface ipv4 show excludedportrange protocol=tcp`. If your port falls inside an excluded range, nothing is using it — Windows has reserved it, and you need to restart with Hyper-V's dynamic port range adjusted or pick another port.
- **Nothing appears in netstat at all.** Check you are looking at the right protocol. `netstat -ano` covers TCP and UDP, but a UDP listener shows no state column, so it is easy to skim past.

## The opposite problem: opening a port

Different symptom, different cause, and worth separating. If your service is running fine but nothing can reach it from another machine, the port is not being held by anything, it is being blocked. Windows Defender Firewall blocks inbound connections by default, and the right fix is an inbound rule for that one port, not switching the firewall off.

From an elevated prompt: `netsh advfirewall firewall add rule name="Dev server 3000" dir=in action=allow protocol=TCP localport=3000`. The guide on [turning off the Windows firewall](https://zepe.online/guides/turn-off-windows-firewall) covers why adding a rule is a better answer than disabling the whole thing, and how to undo either.

> **Editor's note — On avoiding the problem**
>
> Orphaned listeners almost always come from closing the terminal window instead of stopping the process inside it. Pressing **Ctrl + C** and waiting a second for it to exit gives the server a chance to close its socket properly, and saves you this entire sequence next time. It is a small habit that pays off constantly.

## Common questions

### How do I find what is using a port in Windows?

Run `netstat -ano | findstr :3000` in Command Prompt, substituting your port. The last number on each line is the process ID. Look for the line whose state is LISTENING: that is the process holding the port. Confirm what it is with `tasklist /FI "PID eq 1234"` before ending it.

### Why does the port stay in use after I close the program?

Either a detached child process is still listening — closing a terminal kills the shell but not everything it started, or the connection is in TIME_WAIT, which is the operating system waiting out the TCP close sequence rather than anything holding the port. TIME_WAIT clears itself within a couple of minutes.

### Do I need administrator rights to kill a process on a port?

Not to look — netstat runs fine unelevated. You need elevation to end a process owned by another user or by the system, and to work with ports below 1024. If taskkill returns `Access is denied`, reopen the prompt with Win + X then A.

### What is the PowerShell equivalent of netstat -ano?

`Get-NetTCPConnection -LocalPort 3000`, which returns an OwningProcess property. To find and end the process in one line: `Stop-Process -Id (Get-NetTCPConnection -LocalPort 3000).OwningProcess -Force`. Note that it raises an error rather than returning nothing when the port is free.

## Sources

- [netstat — Windows commands reference](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/netstat) — Microsoft Learn. Supports: The meaning of the -a, -n and -o switches and the columns in the output, including the owning process ID.
- [taskkill — Windows commands reference](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/taskkill) — Microsoft Learn. Supports: The /F and /PID switches and the exact success and access-denied messages.
- [tasklist — Windows commands reference](https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/tasklist) — Microsoft Learn. Supports: The /FI filter syntax used to confirm a process name from its PID.

## Related guides

- https://zepe.online/guides/open-terminal-windows
- https://zepe.online/guides/force-quit-app-windows
- https://zepe.online/guides/turn-off-windows-firewall

---

© 2026 Zepe. Windows is a trademark of Microsoft Corporation; this site is not affiliated with Microsoft.