How to Identify which Windows Process is Locking a File or Folder

While attempting to delete, move, or rename a file or folder you get a Windows warning message; the Operating System refuses to complete the operation.

This article helps identifying the process that currently has a handle on the file or folder you are attempting a maintenance operation on.

Symptoms

When trying to delete, move, or rename a file you get a Windows system warning message:

• «Cannot delete file: Access is denied».
• «There has been a sharing violation».
• «The source or destination file may be in use».
• «The file is in use by another program or user».
• «Make sure the disk is not full or write-protected and that the file is not currently in use».

How to Solve the Issue

One of the easiest ways to handle locked files or folders is to use Microsoft Sysinternals Process Explorer.

Identify what program is using a file

Using Process Explorer there is a simple way to find the program:

1. Open Process Explorer
   • Running as administrator.
2. On the toolbar, find the gunsight icon on the right.
3. Drag the icon and drop it on the open file or folder that is locked.
4. The executable that is using the file will be highlighted in the Process Explorer main display list.

Identify which handle or DLL is using a file

1. Open Process Explorer
   • Running as administrator.
2. Enter the keyboard shortcut Ctrl+F.
   • Alternatively, click the “Find” menu and select “Find a Handle or DLL”.
3. A search dialog box will open.
4. Type in the name of the locked file or other file of interest.
   • Partial names are usually sufficient.
5. Click the button “Search”.
6. A list will be generated.
   • There may be a number of entries.

Release the lock on the file or folder

To release the lock on the file you are attempting the maintenance operation on, you will need to kill the appropriate process. An individual program or handle in the list provided by Process Explorer can be killed by:

1. Selecting the process/handle/program entry.
   
2. Pressing the delete key.

Proceed with care when deleting handles as this may generate erratic behavior and instabilities may occur.

How to Use Resource Monitor to Find Which Process Has Locked a File?

I know many folks that use Windows SysInternals Process Explorer to gather information about running processes and their open handles. There is an excellent but less familiar utility in-built with Windows 7 and higher, called Resource Monitor which provides complete details of running processes, their associated handles and associated modules (for example, DLL files).

1. To launch Resource Monitor, press WinKey + R, type resmon.exe and press ENTER.

2. Select the CPU tab, and expand Associated Handles by clicking on its title bar

3. Type a file name or part of the file name in the text box provided. This should list the processes which are currently accessing the file(s)

Bonus Tip! You can also type a registry key in the search field, which would cause Resource Monitor to show the registry handles with the corresponding process names.

View Associated Modules for a Process

There is another option wherein you can view the list of modules that are in use by a given process. Simply select one or more processes in the Processes section, and then expand the Associated Modules section to view the list of modules used by the selected processes.

Resource Monitor proves to be an useful tool to investigate processes and locked files, and can come in handy especially when you forget to bring your troubleshooting toolkit along when fixing a friend’s PC. «Associated Handles» and «Associated Modules» is a nice feature addition in Windows 7 and higher. You can also use Process Explorer to find this info. Check out Know which process has locked a file.

Incidentally, you may’ve also noticed that the «File in Use» dialog in Windows 7 and higher, displays the Process Name as well.

Related

Want to find which program is eating away your internet bandwidth? Resource Monitor can tell that too.

How to find out which process is locking a file or folder in Windows 10

August 11, 2020 By Sambit Koley

If you are trying to modify/ delete any particular file on your computer but an error message appears stating “The action can’t be completed because the folder is open in another program“, you can’t delete/ modify the file without stopping the other program which is using it. Some Windows 10 users are Follow the processes described in this article to find out which process is ‘locking’ the file on your computer, stop the process and you will be able to modify/ delete the file again on your computer.

Example–

At our end, we have tried to delete “adobe” from the Temp folder and it has returned an error message saying “The action can’t be completed because the file is open in Adobe Genuine Software Integrity Service“.

In both of the methods described below, we are going to use this case.

Method-1 Use Resource Monitor to detect and end the process-

In the Resource Monitor window, you can detect which application or service handle is holding the particular file, so you can easily end the process from there.

1. Press Windows key+R to launch Run window on your computer. In the Run window, type “resmon” and hit Enter.

Resource Monitor window will be opened on your computer.

2. In the Resource Monitor window, go to the “CPU” tab.

3. Now, expand “Associated Handles” and then in the search box type the name of the file you are facing trouble with (for us, it will be “adobegc“) and then click on the blue arrow in the same box to see the associated handles of that file.

4. You will see the associated handles for the file in the Associated Handles tab. Right-click on the process which is locking the file and then click on “End Process” to end the process on your computer.

After ending the particular service, try to modify/ delete the file again. This time, you will be able to do it. If you face any further problem go for the second method.

Method-2 Use Process Explorer-

Process Explorer is a tool from Microsoft which is very useful to detect any associated process holding any particular service on your computer.

1. Download Process Explorer on your computer.

2. After downloading the zip file, go to the downloaded location. Extract the downloaded “ProcessExplorer” zip file in a location of your choice.

3. Now, go to the extraction site on your computer. Double click on “procexp64” to run it on your computer (In case if you are using 32-bit Windows 10, you should run “procexp” on your computer).

4. In Process Explorer window, click on “Find” on the menu bar and then click on “Find Handle or DLL…” on your computer.

Wait for a while as Process Explorer will find the processes associated with the string you have entered.

5. In Process Explorer Search window, enter the search string beside ‘Handle or DLL substring:‘ and then click on “Search” just beside the search box.

6. Wait for a while as the Process Explorer will list the processes which are using the file. When the search is complete, click on the process in the process tab.

The following process will be highlighted in the Process Explorer window.

7. In Process Explorer window, right-click on the highlighted process and then click on “Close handle” to close the process on your computer.

Once you have closed the process, close the Process Explorer window on your computer.

That’s it! Now, you can easily modify/ delete the file on your computer. Your problem should be solved.

Sambit is a Mechanical Engineer By qualification who loves to write about Windows 10 and solutions to weirdest possible problems.

How to Identify the Process that has Locked a File in Windows

When you attempt to delete a file or folder which is in use by a process, the File In Use dialog appears showing the name of the program that has locked the file.

However, there are cases where the “File In Use” dialog doesn’t show the name of the process that has a lock on the file you’re trying to delete. In some cases, the dialog will show “the action can’t be completed because the file is open in another process“.

For investigating processes and locked files, Windows Sysinternals Process Explorer is probably the first option that comes to mind for most users. However, there are two built-in solutions to display the current open files list along with corresponding process names.

Find which process has locked a file using:

1. Resource Monitor

Resource Monitor (resmon.exe) is a built-in tool that has many useful features. With Resource Monitor, you can track current network and internet usage, view associated handles for locked files, as well as manage processes just as you’d using the Task Manager.

To find the process name that has a file locked, click the CPU tab, type the file name or part of it in the Associated Handles text box.

2. Process Explorer

Process Explorer needs no introduction. In Process Explorer, all you need to do is use the Find feature and type in the file name. This shows the process that’s accessing the file.

From the lower pane view, you can close the file handle if necessary.

You must run Process Explorer as administrator in order to manage processes which are running elevated. To elevate Process Explorer, click the File menu → Show Details for All Processes.

3. Handle from Windows Sysinternals

Handle is a utility from Microsoft Sysinternals that displays information about open handles for any process in the system. You can use it to see the programs that have a file open, or to see the object types and names of all the handles of a program. Handle is like a command-line version of Process Explorer.

Note: Handle v4.21 has a small bug where it always reports “No matching handles found” if the drive-letter is in uppercase. Hope Microsoft fixes it in the next update.

From an admin Command Prompt window, use the command-line syntax to find the process which is having the file open:

If the file name contains spaces, enclose it within double quotes.

Example:

(Mentioning the filename without the path may not necessarily work in every situation. It’s advisable to include the full path always.)

The output shows the process name, the process identifier, user name, the locked (target) file name with path.

Sysinternals Handle: Command-line arguments

-a	Dump all handle information.
-l	Just show pagefile-backed section handles.
-c	Closes the specified handle (interpreted as a hexadecimal number). You must specify the process by its PID.WARNING: Closing handles can cause application or system instability.
-y	Don’t prompt for close handle confirmation.
-s	Print count of each type of handle open.
-u	Show the owning user name when searching for handles.
-p	Dump handles belonging to process (partial name accepted).
name	Search for handles to objects with (fragment accepted).
-nobanner	Do not display the startup banner and copyright message.

No arguments will dump all file references.

Add Sysinternals Handle to right-click menu

You can add Sysinternals Handle to the right-click menu for files to quickly find the program that has locked the file. To add it to the context menu, follow these steps:

1. Download Handle from Microsoft Sysinternals site.
2. Copy the files handle.exe & handle64.exe to a folder – e.g., d:\tools
3. Copy the following lines of code to Notepad, and save the file as find_handle.vbs to a permanent location.

Note: The Sysinternals Handle.exe path is hard-coded as d:\tools\handle.exe in the above script. If the program is located on a different path, modify the path in the script accordingly. For 64-bit Windows, you can use either handle.exe or handle64.exe

Double-click find_handle.vbs to add the context menu entry in the registry. You’ll need to do this only once. But, if you relocate the script to a different folder, you’ll need to double-click it again to update the path in the registry.

You’ll see the Find Handle option when you right-click on a file. Clicking on it will launch the script which in turn runs handle.exe with the filename argument to find the process which has the file locked.

To remove the Find Handle context menu entry, start the Registry Editor ( regedit.exe ) and delete the following key:

4. OpenFiles.exe — a built-in console tool

Another built-in tool we’re going to use is Openfiles.exe, a console tool that’s not new to Windows. It was originally introduced in 2000 as part of the Windows Resource Kit 2000/2003 tools. This utility was then included by default in Windows Vista and higher (including Windows 10). Openfiles displays the currently open files list from local or shared folders, along with the Handle ID and Process executable name. This tool also allows you to disconnect one or more files that are opened remotely from a shared folder.

Enable “Maintain Objects List” global flag for the First time

First, to enable tracking of local file handles, you need to turn on ‘maintain objects list’ flag by running the following command from admin Command Prompt.

You’ll see the following message:

INFO: The system global flag ‘maintain objects list’ is currently enabled.

You’ll need to run this command for the first time only. Then restart Windows for the change to take effect.

View open files and the corresponding process names

After restarting Windows, from an admin Command Prompt window, type:

This lists the File/Handle ID, Process Name and the list of files opened locally or opened remotely via local share points, in a table format.

To view the output in List or CSV formats, use the /query parameter.

To copy the output to clipboard, pipe the output to Clip.exe as below. Then paste the output in Notepad or any other editor of your choice.

For more information on copying Command Prompt output to clipboard or save the output to a file, check out the article How to Copy Command Prompt Output Text to Clipboard or Save to File?

To find if a particular file is being in use by a program (and to know which program), you may use the following command-line.

The above command lists all open files that contain the word “eiffel” in the file name. In this example, Word 2016 is currently having the lock over the file “The Eiffel Tower.docx” (ID 4576).

And “File In Use” dialog tells me the same thing.

Disconnect files opened remotely from shared folder.

To disconnect files opened from shared folder so that you can delete, rename the file or modify the contents, use the /disconnect parameter to cut connections to that file. Here are the command-line options.

Openfiles.exe perfectly does the job of listing all open files along with the process names, but it can’t forcibly kill processes. However, this excellent (but overlooked) built-in console tool can come in handy when you want to quickly find a process name that’s using a file, or to disconnect a file that’s being accessed through a shared folder by a network user — without depending on a third-party solution.

5. OpenedFilesView

OpenedFilesView from Nirsoft displays the list of all opened files on your system. For each opened file, additional information is displayed: handle value, read/write/delete access, file position, the process that opened the file, and more… Optionally, you can also close one or more opened files, or close the process that opened these files.

Читайте также:  Windows help format program