1. Identifying File Usage

---

1.1 Using Resource Monitor (Resmon)

Windows provides a built-in utility called Resource Monitor located at:

C:\Windows\System32\resmon.exe

There are three ways to launch it:

• Create a desktop shortcut for frequent access.
• Type resmon in the command prompt.
• From Task Manager → Performance tab → click the ellipsis (⋯) → select "Open Resource Monitor".

Once open, go to the CPU tab and search under "Associated Handles" to find which processes are using a specific file or folder.

1.2 Using OpenFiles

The openfiles command-line utility allows administrators to view and disconnect open files. Here are some common commands:

> openfiles /?
> openfiles /Query
> openfiles /Local on

After enabling local file tracking with openfiles /Local on, you can view all open files using:

> openfiles

This displays a list of open files including process IDs (PIDs) and file paths.

1.3 Third-Party Tools

Tools like Sysinternals Handle and Unlocker can also be used to manage locked files. These are especially useful when built-in tools are insufficient.

2. Managing Port Usage

---

2.1 Useful Port References

For standard port assignments, refer to:

• IANA Protocols
• IANA Port Assignments
• Wikipedia TCP/UDP Port List

2.2 Dynamic Port Range

To view the current dynamic port range for TCP:

> netsh int ipv4 show dynamicportrange protocol=tcp

Example output:

Start Port : 49152
Number of Ports : 16384

To change the dynamic port range:

> netsh int ipv4 set dynamicportrange protocol=tcp startport=10000 numberofports=20000

2.3 Excluded Port Ranges

To view excluded port ranges:

> netsh int ipv4 show excludedportrange protocol=tcp

To add an excluded port range:

> netsh int ipv4 add excludedportrange protocol=tcp startport=50000 numberofports=20

To remove an excluded port range:

> netsh int ipv4 delete excludedportrange protocol=tcp startport=50000 numberofports=20

2.4 Listing All Listening Ports and PIDs

Use the following command to list all active connections and listening ports with their PIDs:

> netstat -ano

Sample output:

Proto  Local Address          Foreign Address        State           PID
TCP    0.0.0.0:5040           0.0.0.0:0              LISTENING       4844
TCP    [::1]:49664            [::]:0                 LISTENING       3788
UDP    0.0.0.0:5050           *:*                                    4844

2.5 Checking PID for a Specific Port

To find the PID for a specific port (e.g., 1900):

> netstat -ano | findstr :1900

To find the process name using that PID:

> tasklist | findstr 8608

You can also use Task Manager (under Details tab) to sort by PID and identify the process.

3. Closing Ports or Services

---

3.1 RPC (Port 135)

RPC is managed by the svchost.exe -k rpcss process. To disable it:

1. Run dcomcnfg → Component Services → My Computer → Properties → uncheck "Enable Distributed COM on this computer".
2. Go to Registry Editor → HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Rpc\Internet → create a new key if missing.
3. Reboot the system.

3.2 NetBIOS (Port 139)

To disable NetBIOS over TCP/IP:

1. Open Network and Sharing Center → Change adapter settings.
2. Right-click the network adapter → Properties → select Internet Protocol Version 4 (TCP/IPv4) → Properties → Advanced → WINS tab → select "Disable NetBIOS over TCP/IP".

3.3 SMB (Port 445)

To disable SMB:

1. Open Registry Editor → navigate to HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\NetBT\Parameters.
2. Create a new QWORD value named SMBDeviceEnabled and set it to 0.
3. Alternatively, disable the Server service via Services manager.

3.4 WinRM (Ports 5985, 5986)

To disable WinRM:

1. Open Windows Firewall with Advanced Security.

2. Locate the rule named "Windows Remote Management (HTTP-In)" and disable it.

3. Secure File Sharing via Web

---

4.1 Using Python HTTP Server (Windows and Linux)

Use Python's built-in HTTP server to share files securely:

python -m http.server
python -m http.server 9000

Access via browser:

http://192.168.1.10:9000

4.2 Using Python HTTP Server (macOS)

On macOS, use:

python3 -m http.server 9000

Create an alias for convenience:

alias http-server="python3 -m http.server"
http-server 8080

5. Monitoring Listening Ports and Processes

---

After closing unnecessary ports, monitor active connections using:

> netstat -ano

Match the PID with process names using Task Manager or tasklist.

6. Command Help References

---

6.1 Netstat Help

> netstat -?

Common options:

• -a: Show all connections and listening ports.
• -n: Display addresses and port numbers in numerical form.
• -o: Show process ID for each connection.
• -p: Show connections for the specified protocol (TCP, UDP).

6.2 Netcfg Help

> netcfg /?

Useful for installing or uninstalling network components:

netcfg -l c:\oemdir\myprot.inf -c p -i myprot
netcfg -u MS_IPX

6.3 Netsh Help

> netsh ?

Common sub-contexts:

• interface: Manage network interfaces.
• advfirewall: Configure Windows Firewall.
• dhcpclient: Manage DHCP client settings.