diff --git a/portlist/netstat_exec.go b/portlist/netstat_exec.go
index 3f7ac04bf..b228dbed3 100644
--- a/portlist/netstat_exec.go
+++ b/portlist/netstat_exec.go
@@ -13,12 +13,22 @@ import (
 	exec "tailscale.com/tempfork/osexec"
 )
 
+var osHideWindow func(*exec.Cmd) // non-nil on Windows; see portlist_windows.go
+
+// hideWindow returns c. On Windows it first sets SysProcAttr.HideWindow.
+func hideWindow(c *exec.Cmd) *exec.Cmd {
+	if osHideWindow != nil {
+		osHideWindow(c)
+	}
+	return c
+}
+
 func listPortsNetstat(arg string) (List, error) {
 	exe, err := exec.LookPath("netstat")
 	if err != nil {
 		return nil, fmt.Errorf("netstat: lookup: %v", err)
 	}
-	output, err := exec.Command(exe, arg).Output()
+	output, err := hideWindow(exec.Command(exe, arg)).Output()
 	if err != nil {
 		xe, ok := err.(*exec.ExitError)
 		stderr := ""
diff --git a/portlist/portlist_windows.go b/portlist/portlist_windows.go
index 89a048e75..1d38fe5e9 100644
--- a/portlist/portlist_windows.go
+++ b/portlist/portlist_windows.go
@@ -5,7 +5,10 @@
 package portlist
 
 import (
+	"syscall"
 	"time"
+
+	exec "tailscale.com/tempfork/osexec"
 )
 
 // Forking on Windows is insanely expensive, so don't do it too often.
@@ -18,3 +21,9 @@ func listPorts() (List, error) {
 func addProcesses(pl []Port) ([]Port, error) {
 	return listPortsNetstat("-nab")
 }
+
+func init() {
+	osHideWindow = func(c *exec.Cmd) {
+		c.SysProcAttr = &syscall.SysProcAttr{HideWindow: true}
+	}
+}