# NisSrv.exe

Windows Process: Microsoft Corporation

Awọn iwe-aṣẹ wiwa iwe-aṣẹ nissrv, nis, network inspection service

Windows, System Component

Microsoft Defender Antivirus Network Inspection Service. E dey check network traffic for known exploit patterns when Defender dey active.

## Wetin you need know

Dis na Defender wey dey watch network, no be di file scanner.

NisSrv.exe na di Defender Network Inspection Service host. MsMpEng.exe dey scan files. To end NisSrv dey turn off dat network layer until Windows start am again.

- **E safe?**: Check the running file path, signature, and publisher. Name alone no fit confirm say e safe.

  **Same as MsMpEng?**: No. Dis one dey watch di network

  **I suppose end am?**: No if Defender na your antivirus

Feex tok say

If di name na NisSrv and you already trust Windows Security, I go leave di network inspection make e dey run. To end am no go make downloads fast in a way wey go sweet you.

## Wetin be NisSrv.exe?

NisSrv.exe dey host WdNisSvc, di Defender Antivirus Network Inspection Service. E dey look for exploit-like traffic patterns. E no be SmartScreen reputation check and e no be di file scanner.

## Wetin e dey do?

E dey sit on di network path when Defender real-time protection dey on. MsMpEng.exe still dey control on-access file scans. Di two of dem fit dey at di same time.

## Wetin make am dey run?

Windows Security na di active antivirus. Any third-party suite wey off Defender suppose also stop dis service. If both dey run, dem fit dey fight each other.

## Inspect the running instance

Inside Windows PowerShell, this read-only query show matching process IDs, creation times and executable paths on this PC. (pcm)

`Get-CimInstance -ClassName Win32_Process | Where-Object { $_.Name -eq 'NisSrv.exe' } | Select-Object ProcessId, ParentProcessId, CreationDate, Name, ExecutablePath | Format-List`

No result or a path we no fit access is inconclusive. Protected processes fit restrict access, and process IDs fit be reused. Keep personal paths local. (pcm)

Use the [file-identity guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/) to compare signatures and product metadata. A filename alone no fit establish safety. (pcm)

## E dey safe?

Check dis running file

Di real NIS host dey stay under Defender platform folder with MsMpEng. Any NisSrv.exe inside game folder no be Defender.

Compare the recorded location with the actual file. A familiar folder alone no fit establish identity. (pcm)

`C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\NisSrv.exe`

- Expected publisher: Microsoft Corporation
- Related service: WdNisSvc
- Version folder dey change as Defender platform dey update

## I fit end am?

No advise am

To end NisSrv dey drop network inspection until di service restart. Dat one na security gap, no be gaming tweak wey Microsoft document say e safe.

## I fit comot am?

No

No delete NisSrv.exe. Off Defender only if another antivirus dey control di PC, and do am from Windows Security, no be Explorer.

## E suppose start with Windows?

WdNisSvc dey start with Defender. E no suppose show as separate Startup Apps entry wey you go comot for speed.

## Measure resource use

| CPU and memory   | Compare several observations for the same PID and workload. This entry get no independently measured universal baseline. (pcm)               |
| ---------------- | -------------------------------------------------------------------------------------------------------------------------------------------- |
| Disk and network | Attribute activity to the actual process and current task; a filename alone no fit establish expected destinations or transfer volume. (pcm) |

## File information

| Executable name            | NisSrv.exe                                                                         |
| -------------------------- | ---------------------------------------------------------------------------------- |
| Recorded installation path | C:\ProgramData\Microsoft\Windows Defender\Platform\\\<version>\NisSrv.exe          |
| Publisher                  | Microsoft Corporation                                                              |
| Signature check            | Inspect the actual file; this entry no dey certify its certificate identity. (pcm) |

## Related services

WdNisSvc na di network inspection contract. WinDefend na di main Defender service.

WinDefend Windows Service

## Common wahala dem

### VPN or packet filter conflicts

Some VPN filters and NisSrv dey sit on di same stack. Test di VPN vendor guidance before you disable Defender.

### People dey end am together with MsMpEng

Dat one dey turn off two Defender layers at once. Use Windows Security if you install another antivirus.

## How to troubleshoot

Diagnose before you change anything wey fit scatter things.

### Check which antivirus dey active

Windows Security dey show who get am. If Defender dey off, make NisSrv no be your first target to hunt.

### No rename di file

Servicing go repair or scatter protection. Use di product UI.

## Technical details

Technical details

| Image name | NisSrv.exe |
| ---------- | ---------- |
| Service    | WdNisSvc   |

## Check the identity of running file

A filename alone no fit establish safety. Verify the actual path, signature and product identity. (pcm)

## Related

Dis entities connect to dis article. Type dey show for every link.

[WinDefend: Windows Service](https://feex.it/wiki/l/pcm/service/windows-defender/)[MsMpEng.exe: Windows Process](https://feex.it/wiki/l/pcm/process/msmpeng.exe/)[WinDefend: Windows Service](https://feex.it/wiki/l/pcm/service/windows-defender/)[Windows Security: Application](https://feex.it/wiki/l/pcm/software/windows-security/)[Check an executable path and digital signature: Guide](https://feex.it/wiki/l/pcm/software/system/verify-executable-path-signature/)[Read Task Manager and compare process activity: Guide](https://feex.it/wiki/l/pcm/software/system/how-to-read-task-manager/)[Security processes: Category](https://feex.it/wiki/process/security/)

## Sources and verification

Recorded source label: August 2026. Dis label no establish independent verification. [How we dey do research](https://feex.it/wiki/research/).

- [Microsoft Learn: Network inspection ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/network-protection)· Defender network protection
- [Microsoft Learn: Microsoft Defender Antivirus ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)· Engine versus NIS
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on top Windows PCs. No be lab benchmark.
- [Microsoft Sysinternals: Sigcheck ](https://learn.microsoft.com/en-us/sysinternals/downloads/sigcheck)· Dey explain how to check file signatures. Dis reference no establish the identity or safety of any particular running file.
- [Microsoft: Get-CimInstance ](https://learn.microsoft.com/en-us/powershell/module/cimcmdlets/get-ciminstance)· Read-only local process-query method. (pcm)
- [Microsoft: Win32_Process properties ](https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/win32-process)· Documents process IDs, executable paths, creation dates and parent-ID reuse. (pcm)

## Dis article make sense to you?

Yes or no dey enough. Choose reason if you want, or add short note.

Quick facts

The short identity of dis page. Specs, sources, and the full story still dey inside the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: NisSrv.exe

  **Related service**: WdNisSvc

  **Record context**: Feex Wiki reference entry

Recorded source status: Feex Reviewed: Recorded source label: August 2026. Dis label no establish independent verification.

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/l/pcm/process/nissrv.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)