WinInit.exe Stealing Port 5000

On a Server 2012 R2 machine, I couldn’t figure out why WiniInit.exe, which loads at Windows startup, was using port 5000, which I wanted to use for an application. My understanding, e.g. from this thread, was that WinInit was supposed to use the first dynamic port. And this machine has the standard dynamic range starting at 49152:

C:\>netsh int ipv4 show dynamicport tcp

Protocol tcp Dynamic Port Range
———————————
Start Port      : 49152
Number of Ports : 16348

A partner support rep pointed me to the HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet registry key, which in fact listed Ports 5000-5050 on my machine. Why?

Fortunately I put a note in the firewall description to remind me that I opened those ports to allow an older COM+ application through the firewall. That followed the recommendations in MSKB 250367.

The solution was to change HKEY_LOCAL_MACHINE\Software\Microsoft\Rpc\Internet\Ports to 5010-5050 and make the corresponding change to the firewall. (Don’t extend the range to 5060, as that port is used by VoIP applications!) After the reboot, WinInit.exe was on port 5010 and my COM+ application was still working through the firewall.

Not sure why WinInit uses the registry key instead of the dynamic port range defined by netsh, but at least this lets me free up port 5000.

MSKB 154596 has more info on this registry key, and this article has some history of the registry key and the netsh command.