Port 445 is bound to the System process and managed by the kernel-mode networking stack rather than a typical user-mode service process like svchost.exe because:
The Windows kernel (via ntoskrnl.exe) directly binds to certain ports at startup, including 445, for performance and security reasons. This enables it to handle SMB traffic efficiently at the kernel level rather than depending on a user-mode service to open the port.
In Windows, networking is handled through the NDIS framework. NDIS has kernel-mode drivers that manage incoming network requests, which includes setting up ports at the kernel level. Port 445 remains bound to the System process even if LanmanServer (SMB server) is disabled because the NDIS framework keeps the port open at the kernel level, ensuring availability if the service is later enabled.
The LanmanServer service doesn’t directly open port 445. Instead, it relies on the kernel to listen on this port and route SMB-related requests to it. Disabling LanmanServer doesn’t close the port because the System process maintains the port binding, awaiting any future SMB requests if the service is re-enabled.