Troubleshooting: SocketException 10013 at Web portal startup

Symptom:

FATAL Program - A fatal error occurred during application startup.
System.Net.Sockets.SocketException (10013): An attempt was made to access a socket in a way forbidden by its access permissions.

This Windows error (WSAEACCES) means the application cannot bind the network socket to the configured port. It happens before the Web portal becomes available.

Case 1 - The port is already in use by another process

Description: Another process is already listening on the port used by the Web portal (80, 443, or a custom port).

Diagnosis:

# Replace <PORT> with the configured port (for example 443)
netstat -ano | findstr :<PORT>

Identify the PID in the last column, then run:

Get-Process -Id <PID>

Resolution:

Stop or reconfigure the conflicting process.
Common cases: IIS, Apache, another Web portal instance, or an RDP Gateway server.
If IIS is involved: run iisreset /stop or disable the relevant site in IIS Manager.

Case 2 - Insufficient rights to listen on a privileged port (< 1024)

Description: On Windows, listening on ports 80 or 443 requires either administrator rights or an explicit URL ACL reservation.

Diagnosis:

# Check existing URL reservations
netsh http show urlacl

Also verify that the TSplus service runs under an account with sufficient rights (Services Manager → service properties → “Log On” tab).

Resolution:

Add a URL ACL reservation for the service account:

# Replace <PORT> and <DOMAIN\USER> with the real values
netsh http add urlacl url=http://+:<PORT>/ user="<DOMAIN\USER>"
netsh http add urlacl url=https://+:<PORT>/ user="<DOMAIN\USER>"

Or configure the service to run as LocalSystem / local administrator.

Case 3 - A previous WebPortal instance was not stopped

Description: After an abnormal stop (crash, forced reboot), a residual Web portal process may still hold the port.

Diagnosis:

Get-Process | Where-Object { $_.Name -like "*TSplus*" -or $_.Name -like "*WebPortal*" }

Resolution:

# Stop TSplus services cleanly
Stop-Service -Name "TSplus*" -Force

# If a residual process remains, stop it by PID
Stop-Process -Id <PID> -Force

Wait a few seconds before restarting the service.

Case 4 - Blocked by Windows Firewall or antivirus

Description: Windows Defender, a third-party antivirus, or a firewall rule blocks the socket bind attempt.

Diagnosis:

# Check enabled inbound firewall rules
Get-NetFirewallRule | Where-Object { $_.Enabled -eq 'True' -and $_.Direction -eq 'Inbound' } | Select-Object DisplayName, Action | Sort-Object Action

Also review Windows Defender / antivirus logs for blocked events around startup time.

Resolution:

Create a firewall exception for the Web portal executable and/or the port in use.
Temporarily disable the antivirus to confirm whether it is the cause, then add a targeted exclusion.

# Add an inbound allow rule
New-NetFirewallRule -DisplayName "TSplus WebPortal" -Direction Inbound -Protocol TCP -LocalPort <PORT> -Action Allow

Case 5 - Conflict with the Windows HTTP.sys service

Description: HTTP.sys (the Windows HTTP driver used by IIS, WCF, and others) has a reservation on the target port or URL, preventing another application from binding directly to the socket.

Diagnosis:

netsh http show urlacl | Select-String -Pattern "<PORT>"
netsh http show servicestate

Resolution:

Remove the conflicting reservation:

netsh http delete urlacl url=http://+:<PORT>/

Or configure the Web portal to use a different port (see the TSplus AdminTool configuration).

Case 6 - Incorrect port configuration in TSplus

Description: The Web portal configuration points to a port that is not available in the environment (for example, a port manually changed in a config file or in the registry).

Diagnosis:

Check the port configured in TSplus AdminTool → Web section → HTTP/HTTPS port. Also check the registry:

HKEY_LOCAL_MACHINE\SOFTWARE\TSplus\WebServer

Resolution:

Correct the port in AdminTool to use a free port.
After the change, restart the TSplus service.

Quick diagnostic command summary

# 1. Identify which process is using the port
netstat -ano | findstr :<PORT>

# 2. List URL ACL reservations
netsh http show urlacl

# 3. Check running TSplus processes
Get-Process | Where-Object { $_.Name -like "*TSplus*" }

# 4. View active firewall rules
Get-NetFirewallRule -Enabled True -Direction Inbound | Select-Object DisplayName, Action

Note: After any change, restart the TSplus service from Windows Services (services.msc) or with:
Restart-Service -Name "TSplus*"

Helpdesk