NisSrv.exe
Also called nissrv, nis, network inspection service
Microsoft Defender Antivirus Network Inspection Service. It inspects network traffic for known exploit patterns when Defender is active.
What you need to know
This is Defender watching the network, not the file scanner.
NisSrv.exe is the Defender Network Inspection Service host. MsMpEng.exe scans files. Ending NisSrv turns off that network layer until Windows starts it again.
- Safe?
- Yes, with Defender
- Same as MsMpEng?
- No. This one watches the network
- Should I end it?
- No if Defender is your antivirus
What is NisSrv.exe?
NisSrv.exe hosts WdNisSvc, the Defender Antivirus Network Inspection Service. It looks for exploit-like traffic patterns. It is not SmartScreen's reputation check and it is not the file scanner.
What does it do?
It sits on the network path when Defender real-time protection is on. MsMpEng.exe still owns on-access file scans. Both can be present at once.
Why is it running?
Windows Security is the active antivirus. A third-party suite that disabled Defender should also stop this service. If both run, they can fight.
Is it safe?
Usually safe
The legitimate NIS host lives under the Defender platform folder with MsMpEng. A NisSrv.exe in a game folder is not Defender.
A legitimate copy normally runs from:
C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\NisSrv.exe
- Expected publisher: Microsoft Corporation
- Related service: WdNisSvc
- Version folder changes with the Defender platform
Can I end it?
Not recommended
Ending NisSrv drops network inspection until the service restarts. That is a security gap, not a gaming tweak Microsoft documents as safe.
Can I remove it?
No
Do not delete NisSrv.exe. Turn off Defender only if another antivirus owns the PC, and do that from Windows Security, not Explorer.
Should it start with Windows?
WdNisSvc starts with Defender. It should not appear as a separate Startup Apps entry you remove for speed.
Normal resource behavior
These are contextual labels, not universal averages.
- CPU
- Can rise on a noisy network or during an inspection signature update
- Memory
- Moderate
- Disk
- Low
- Network
- This is the point of the process
File information
| Executable name | NisSrv.exe |
|---|---|
| Common legitimate path | C:\ProgramData\Microsoft\Windows Defender\Platform\<version>\NisSrv.exe |
| Publisher | Microsoft Corporation |
| Signature expectation | Signed by Microsoft Windows |
Common problems
VPN or packet filter conflicts
Some VPN filters and NisSrv both sit on the stack. Test the VPN vendor guidance before you disable Defender.
People end it with MsMpEng
That turns off two Defender layers at once. Use Windows Security if you installed another antivirus.
Troubleshooting
Diagnose before you change anything destructive.
Check which antivirus is active
Windows Security shows the owner. If Defender is off, NisSrv should not be your first hunt.
Do not rename the file
Servicing will repair or break protection. Use the product UI.
Technical details
Technical details
| Image name | NisSrv.exe |
|---|---|
| Service | WdNisSvc |
Sources and verification
Reviewed by Feex editorial. Last verified August 2026 Status: Feex Reviewed. How we research.
- Microsoft Learn: Network inspection · Defender network protection
- Microsoft Learn: Microsoft Defender Antivirus · Engine versus NIS
- Foxhole process map · First-party samples on Windows PCs. Not a lab benchmark.
Was this article useful?
A yes or no is enough. Pick a reason if you want, or add a short note.
Thanks. That helps us improve this page.