# NisSrv.exe

Windows Process: Microsoft Corporation

Also called nissrv, nis, network inspection service

Windows, System Component

Microsoft Defender Antivirus Network Inspection Service. It inspects network traffic for known exploit patterns when Defender is active.

## What you need to know

This is Defender watching the network, not the file scanner.

NisSrv.exe is the Defender Network Inspection Service host. MsMpEng.exe scans files. Ending NisSrv turns off that network layer until Windows starts it again.

- **Safe?**: Yes, with Defender

  **Same as MsMpEng?**: No. This one watches the network

  **Should I end it?**: No if Defender is your antivirus

Feex says

If the name is NisSrv and you already trust Windows Security, I would leave the network inspection up. Ending it does not make downloads faster in a way you will like.

## What is NisSrv.exe?

NisSrv.exe hosts WdNisSvc, the Defender Antivirus Network Inspection Service. It looks for exploit-like traffic patterns. It is not SmartScreen's reputation check and it is not the file scanner.

## What does it do?

It sits on the network path when Defender real-time protection is on. MsMpEng.exe still owns on-access file scans. Both can be present at once.

## Why is it running?

Windows Security is the active antivirus. A third-party suite that disabled Defender should also stop this service. If both run, they can fight.

## Is it safe?

Usually safe

The legitimate NIS host lives under the Defender platform folder with MsMpEng. A NisSrv.exe in a game folder is not Defender.

A legitimate copy normally runs from:

`C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\NisSrv.exe`

- Expected publisher: Microsoft Corporation
- Related service: WdNisSvc
- Version folder changes with the Defender platform

## Can I end it?

Not recommended

Ending NisSrv drops network inspection until the service restarts. That is a security gap, not a gaming tweak Microsoft documents as safe.

## Can I remove it?

No

Do not delete NisSrv.exe. Turn off Defender only if another antivirus owns the PC, and do that from Windows Security, not Explorer.

## Should it start with Windows?

WdNisSvc starts with Defender. It should not appear as a separate Startup Apps entry you remove for speed.

## Normal resource behavior

These are contextual labels, not universal averages.

- **CPU**: Can rise on a noisy network or during an inspection signature update

  **Memory**: Moderate

  **Disk**: Low

  **Network**: This is the point of the process

## File information

| Executable name        | NisSrv.exe                                                                |
| ---------------------- | ------------------------------------------------------------------------- |
| Common legitimate path | C:\ProgramData\Microsoft\Windows Defender\Platform\\\<version>\NisSrv.exe |
| Publisher              | Microsoft Corporation                                                     |
| Signature expectation  | Signed by Microsoft Windows                                               |

## Related services

WdNisSvc is the network inspection contract. WinDefend is the main Defender service.

WinDefend Windows Service

## Common problems

### VPN or packet filter conflicts

Some VPN filters and NisSrv both sit on the stack. Test the VPN vendor guidance before you disable Defender.

### People end it with MsMpEng

That turns off two Defender layers at once. Use Windows Security if you installed another antivirus.

## Troubleshooting

Diagnose before you change anything destructive.

### Check which antivirus is active

Windows Security shows the owner. If Defender is off, NisSrv should not be your first hunt.

### Do not rename the file

Servicing will repair or break protection. Use the product UI.

## Technical details

Technical details

| Image name | NisSrv.exe |
| ---------- | ---------- |
| Service    | WdNisSvc   |

## Related

These entities connect to this article. Type is shown on every link.

[WinDefend: Windows Service](https://feex.it/wiki/service/windows-defender)[MsMpEng.exe: Windows Process](https://feex.it/wiki/process/msmpeng.exe)[WinDefend: Windows Service](https://feex.it/wiki/service/windows-defender)[Windows Security: Application](https://feex.it/wiki/software/windows-security)

## Sources and verification

Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. [How we research](https://feex.it/wiki/research).

- [Microsoft Learn: Network inspection ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/network-protection)· Defender network protection
- [Microsoft Learn: Microsoft Defender Antivirus ](https://learn.microsoft.com/microsoft-365/security/defender-endpoint/microsoft-defender-antivirus-windows)· Engine versus NIS
- [Foxhole process map ](https://foxhole.feex.it/)· First-party samples on Windows PCs. Not a lab benchmark.

## Was this article useful?

A yes or no is enough. Pick a reason if you want, or add a short note.

Quick facts

The short identity of this page. Specs, sources, and the full story stay in the article.

- **Type**: Windows Process

  **Publisher**: Microsoft Corporation

  **Executable**: NisSrv.exe

  **Related service**: WdNisSvc

  **Mapped by Feex**: Seen on Windows PCs in Foxhole

Feex Reviewed: Last verified August 2026

---

Source: [Canonical Feex Wiki page](https://feex.it/wiki/process/nissrv.exe/)

[Developer guide](https://feex.it/wiki/developers/) | [API policy](https://feex.it/developers/api-policy/) | [Agent guidance](https://feex.it/wiki/llms.txt)