Skip go content

NisSrv.exe

Windows ProcessMicrosoft Corporation

Awọn iwe-aṣẹ wiwa iwe-aṣẹ nissrv, nis, network inspection service

WindowsSystem Component

Microsoft Defender Antivirus Network Inspection Service. E dey check network traffic for known exploit patterns when Defender dey active.

Wetin you need know

Dis na Defender wey dey watch network, no be di file scanner.

NisSrv.exe na di Defender Network Inspection Service host. MsMpEng.exe dey scan files. To end NisSrv dey turn off dat network layer until Windows start am again.

E safe?
Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.
Same as MsMpEng?
No. Dis one dey watch di network
I suppose end am?
No if Defender na your antivirus
Feex tok say
If di name na NisSrv and you already trust Windows Security, I go leave di network inspection make e dey run. To end am no go make downloads fast in a way wey go sweet you.

Wetin be NisSrv.exe?

NisSrv.exe dey host WdNisSvc, di Defender Antivirus Network Inspection Service. E dey look for exploit-like traffic patterns. E no be SmartScreen reputation check and e no be di file scanner.

Wetin e dey do?

E dey sit on di network path when Defender real-time protection dey on. MsMpEng.exe still dey control on-access file scans. Di two of dem fit dey at di same time.

Wetin make am dey run?

Windows Security na di active antivirus. Any third-party suite wey off Defender suppose also stop dis service. If both dey run, dem fit dey fight each other.

Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'NisSrv.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the file-identity guide to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

E dey safe?

Check dis running file

Di real NIS host dey stay under Defender platform folder with MsMpEng. Any NisSrv.exe inside game folder no be Defender.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\NisSrv.exe

  • Expected publisher: Microsoft Corporation
  • Related service: WdNisSvc
  • Version folder dey change as Defender platform dey update

I fit end am?

No advise am

To end NisSrv dey drop network inspection until di service restart. Dat one na security gap, no be gaming tweak wey Microsoft document say e safe.

I fit comot am?

No

No delete NisSrv.exe. Off Defender only if another antivirus dey control di PC, and do am from Windows Security, no be Explorer.

E suppose start with Windows?

WdNisSvc dey start with Defender. E no suppose show as separate Startup Apps entry wey you go comot for speed.

Measure resource use

Measure the current process rather than assume a universal baseline
CPU and memory Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)
Disk and network Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm)

File information

NisSrv.exe file information
Executable name NisSrv.exe
Recorded installation path C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\NisSrv.exe
Publisher Microsoft Corporation
Signature check Inspect the actual file; this entry no dey certify its certificate identity. (pcm)

Common wahala dem

VPN or packet filter conflicts

Some VPN filters and NisSrv dey sit on di same stack. Test di VPN vendor guidance before you disable Defender.

People dey end am together with MsMpEng

Dat one dey turn off two Defender layers at once. Use Windows Security if you install another antivirus.

How to troubleshoot

Diagnose before you change anything wey fit scatter things.

Check which antivirus dey active

Windows Security dey show who get am. If Defender dey off, make NisSrv no be your first target to hunt.

No rename di file

Servicing go repair or scatter protection. Use di product UI.

Technical details

Technical details
NisSrv.exe technical details
Image name NisSrv.exe
Service WdNisSvc

Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. How we dey do research.

Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Dis article make sense to you?