It more than likely being used by the operating system server to connect to
the client and is negotiated via dynamic RPC when the client logs on and
normally seen on domain controllers. See the links below on dynamic RPC for
more information. The free tools Process Explorer and TCPView from
SysInternals can show you exactly what is going on with that port. ---
Steve