How to Identify which Windows Process is Locking a File or Folder

While attempting to delete, move, or rename a file or folder you get a Windows warning message; the Operating System refuses to complete the operation.

This article helps identifying the process that currently has a handle on the file or folder you are attempting a maintenance operation on.

Symptoms

When trying to delete, move, or rename a file you get a Windows system warning message:

• «Cannot delete file: Access is denied».
• «There has been a sharing violation».
• «The source or destination file may be in use».
• «The file is in use by another program or user».
• «Make sure the disk is not full or write-protected and that the file is not currently in use».

How to Solve the Issue

One of the easiest ways to handle locked files or folders is to use Microsoft Sysinternals Process Explorer.

Identify what program is using a file

Using Process Explorer there is a simple way to find the program:

1. Open Process Explorer
   • Running as administrator.
2. On the toolbar, find the gunsight icon on the right.
3. Drag the icon and drop it on the open file or folder that is locked.
4. The executable that is using the file will be highlighted in the Process Explorer main display list.

Identify which handle or DLL is using a file

1. Open Process Explorer
   • Running as administrator.
2. Enter the keyboard shortcut Ctrl+F.
   • Alternatively, click the “Find” menu and select “Find a Handle or DLL”.
3. A search dialog box will open.
4. Type in the name of the locked file or other file of interest.
   • Partial names are usually sufficient.
5. Click the button “Search”.
6. A list will be generated.
   • There may be a number of entries.

Release the lock on the file or folder

To release the lock on the file you are attempting the maintenance operation on, you will need to kill the appropriate process. An individual program or handle in the list provided by Process Explorer can be killed by:

1. Selecting the process/handle/program entry.
   
2. Pressing the delete key.

Proceed with care when deleting handles as this may generate erratic behavior and instabilities may occur.

How To Know Which Process is Using a File or Folder in Windows

Ever wondered which program has a particular file or directory open? Quite often, when trying to delete a folder, Windows reports this:

This error also happens with a file, when we tried to move a file, or delete those file. How we can find out which program or application is currently using it and preventing us to delete/move it? To get the process holding those folder or file, we can use these two utilities:

Resource Monitor

For Windows 7 and above, you can use the built-in Resource Monitor.

Open Resource Monitor, which can be found

• By searching for resmon.exe in the start menu, or
• As a button on the Performance tab in your Task Manager

Resource Monitor from Task Manager’s Performance Tab

From CPU tab, use the search field in the Associated Handles section

When you’ve found the handle, you can identify the process by looking at the Image and/or PID column. You can then close the application if you are able to do that, or just right-click the row and you’ll get the option of killing the process (End Process) right there.

Process Explorer

Process Explorer shows you information about which handles and DLLs processes have opened or loaded.

• Open Process Explorer (running as «administrator») by running procexp.exe or procexp64.exe.
• Enter the keyboard shortcut Ctrl+F. Alternatively, click the “Find” menu and select “Find a Handle or DLL”.

Process Explorer — Find Handle or DLL

• Type in the name of the locked file or other file of interest in the Search dialog box, then click «Search». Partial names are usually sufficient.
• A list will be generated. There may be a number of entries. Click one of the entry, it’ll «Refreshing handles».

Process Explorer — Search

Same as Resource Monitor, an individual handle in the list can be killed by selecting it and pressing the delete key (or Close Handle). However, please be careful when deleting handles, as system instabilities may occur. Rebooting your system maybe will free the locked file/folder.

Process Explorer — Close Handle

Handle is a command line version of Process Explorer.

My Take

I prefer to use Resource Monitor compare to Process Explorer since Process Explorer is slower (especially during «Refreshing handles» process). If I can’t find the handle in Resource Monitor, then I use Process Explorer.

Liked this Tutorial? Share it on Social media!

Windows what process uses file

Question

Hi All,
Can you please let me know how to find which applications are using the Page File and how much PF is allocated to each application?

All replies

There’s no easy way to tell how much of a process has actually been paged out to the pagefile (i.e. actually stored in the pagefile thus using it). I am not aware of a tool that reports this information per process.

What is easily available are two PerfMon counters per process called: «Page File Bytes» and «Page File Bytes Peak». The former is also available as «Commit Size» column in task manager. These values represent the amount of memory the process has committed, which is charged against a global commit limit. The commit limit is physical memory size + pagefile size. So as the process commits memory, commit space is reserved for that process out of the total commit limit, which can come from the pagefile or physical memory.

The committed number can be very misleading because a process can commit a lot of memory but not actually touch any of it, in which case he’s not consuming any physical memory or pagefile space. So we don’t recommend using this metric for performance analysis. They are usually useful to find processes that leak memory, or if the system actually starts to run out of commit (in which case one can simply increase the pagefile size, but not necessarily hurt perf since those pages may never be accessed) to see who’s consuming it.

As far as performance analysis goes, amount of paging taking place per process is the interesting metric to look at, since disk then becomes the bottleneck and one would want to reduce that bottleneck. You can see what processes are accessing the page file by opening the Hard Faults summary table in xperf. That would be a pretty decent approximation as to which processes are paging the most.

Find process that created a file on windows

Is there anyway to find what process created a specific file on windows?

2 Answers 2

In general, no. Windows does not record the process that created a given file.

You might be able to use something like SysInternals Process Monitor, which hooks file (and registry I/O), to see if you can catch the file being created, but once it’s created (and the last file handle is closed), Windows forgets which process it came from.

If the file is open in a process that’s currently running, you can use Process Explorer (also from SysInternals) to find out which one.

If you recognise the file extension, that can sometimes help. Or, maybe you can look in the file to see if there’s anything obvious in it.

All you can do is find a match between file type and associated application on mimetypes. But even then it will only be a guess because file types can be associated to several different applications.

Another not-so-successful method will be opening the file in question and searching the header for known application names. Sometimes the app name or token can be found here, but then you need to start with a list of name strings to search for.

Not the answer you’re looking for? Browse other questions tagged windows file process or ask your own question.

Related

Hot Network Questions

Subscribe to RSS

To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

site design / logo © 2021 Stack Exchange Inc; user contributions licensed under cc by-sa. rev 2021.4.16.39093

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

Gizmo’s Freeware

Login / Register

Main menu

How to Find Out Which Windows Process is Using a File

Last updated by v.laurie on 03. February 2021 — 14:53

Ever try to delete, move, or rename a file only to get a Windows system warning with something like one of these messages?

• «Cannot delete file: Access is denied»
• «There has been a sharing violation»
• «The source or destination file may be in use»
• «The file is in use by another program or user».
• «Make sure the disk is not full or write-protected and that the file is not currently in use»

One of the best ways to handle locked files or folders is to use the free Microsoft program Process Explorer. The program has been described in another article and here is how to use it to find out what program, DLL, or handle is using a file or folder. You will need to run as administrator.

How to find out what program is using a file

In Windows 7 or 8, the system message may tell you what program is using the file. If it doesn’t or if you are using Windows XP, there is a simple way to find the program:

1. Open Process Explorer, running as administrator.
2. On the toolbar, find the gunsight icon on the right (shown highlighted in the figure shown below).
3. Drag the icon and drop it on the open file or folder that is locked.
4. The executable that is using the file will be highlighted in the Process Explorer main display list.

How to find out which handle or DLL is using a file

1. Open Process Explorer, running as administrator.
2. Enter the keyboard shortcut Ctrl+F. Altenatively, click the “Find” menu and select “Find a Handle or DLL”.
3. A search dialog box will open.
4. Type in the name of the locked file or other file of interest. Partial names are usually sufficient.
5. Click the button “Search”,
6. A list will be generated. There may be a number of entries.
7. An individual handle in the list can be killed by selecting it and pressing the delete key. However, care is necessary when deleting handles, as instabilities may occur. Often, just rebooting will free a locked file.

Process Explorer can be downloaded here.

Get your own favorite tip published! Know a neat tech tip or trick? Then why not have it published here and receive full credit? Click here to tell us your tip.

This tips section is maintained by Vic Laurie. Vic runs several websites with Windows how-to’s, guides, and tutorials, including a site for learning about Windows and the Internet and another with Windows 7 tips.

Click here for more items like this. Better still, get Tech Tips delivered via your RSS feeder or alternatively, have the RSS feed sent as email direct to your in-box.