How to Identify which Windows Process is Locking a File or Folder

While attempting to delete, move, or rename a file or folder you get a Windows warning message; the Operating System refuses to complete the operation.

This article helps identifying the process that currently has a handle on the file or folder you are attempting a maintenance operation on.

Symptoms

When trying to delete, move, or rename a file you get a Windows system warning message:

• «Cannot delete file: Access is denied».
• «There has been a sharing violation».
• «The source or destination file may be in use».
• «The file is in use by another program or user».
• «Make sure the disk is not full or write-protected and that the file is not currently in use».

How to Solve the Issue

One of the easiest ways to handle locked files or folders is to use Microsoft Sysinternals Process Explorer.

Identify what program is using a file

Using Process Explorer there is a simple way to find the program:

1. Open Process Explorer
   • Running as administrator.
2. On the toolbar, find the gunsight icon on the right.
3. Drag the icon and drop it on the open file or folder that is locked.
4. The executable that is using the file will be highlighted in the Process Explorer main display list.

Identify which handle or DLL is using a file

1. Open Process Explorer
   • Running as administrator.
2. Enter the keyboard shortcut Ctrl+F.
   • Alternatively, click the “Find” menu and select “Find a Handle or DLL”.
3. A search dialog box will open.
4. Type in the name of the locked file or other file of interest.
   • Partial names are usually sufficient.
5. Click the button “Search”.
6. A list will be generated.
   • There may be a number of entries.

Release the lock on the file or folder

To release the lock on the file you are attempting the maintenance operation on, you will need to kill the appropriate process. An individual program or handle in the list provided by Process Explorer can be killed by:

1. Selecting the process/handle/program entry.
   
2. Pressing the delete key.

Proceed with care when deleting handles as this may generate erratic behavior and instabilities may occur.

How do I find out which process is locking a file using .NET?

I’ve seen several of answers about using Handle or Process Monitor, but I would like to be able to find out in my own code (C#) which process is locking a file.

I have a nasty feeling that I’m going to have to spelunk around in the win32 API, but if anyone has already done this and can put me on the right track, I’d really appreciate the help.

Update

Links to similar questions

6 Answers 6

One of the good things about handle.exe is that you can run it as a subprocess and parse the output.

We do this in our deployment script — works like a charm.

Long ago it was impossible to reliably get the list of processes locking a file because Windows simply did not track that information. To support the Restart Manager API, that information is now tracked.

I put together code that takes the path of a file and returns a List

of all processes that are locking that file.

Using from Limited Permission (e.g. IIS)

This call accesses the registry. If the process does not have permission to do so, you will get ERROR_WRITE_FAULT, meaning An operation was unable to read or write to the registry . You could selectively grant permission to your restricted account to the necessary part of the registry. It is more secure though to have your limited access process set a flag (e.g. in the database or the file system, or by using an interprocess communication mechanism such as queue or named pipe) and have a second process call the Restart Manager API.

Granting other-than-minimal permissions to the IIS user is a security risk.

Command-line tool for finding out who is locking a file

I would like to know who is locking a file (win32). I know about WhoLockMe, but I would like a command-line tool which does more or less the same thing.

I also looked at this question, but it seems only applicable for files opened remotely.

7 Answers 7

Handle should do the trick.

Ever wondered which program has a particular file or directory open? Now you can find out. Handle is a utility that displays information about open handles for any process in the system. You can use it to see the programs that have a file open, or to see the object types and names of all the handles of a program.

THis has helped me sooooo many times.

If you want to find what program has a handle on a certain file, run this from the directory that Handle.exe is extracted to. Unless you’ve added Handle.exe to the PATH environment variable. And the file path is C:\path\path\file.txt», run this:

This will tell you what process(es) have the file (or folder) locked.

Handle didn’t find that WhatsApp is holding lock on a file .tmp.node in temp folder. ProcessExplorer — Find works better Look at this answer https://superuser.com/a/399660

Computer Management->Shared Folders->Open Files

In my case Handle.exe did not help. Simple program from official Microsoft called Process Explorer was useful. Just open as administrator and press Ctrl+f , type part of file name it will show process using file.

I have used Unlocker for years and really like it. It not only will identify programs and offer to unlock the folder\file, it will allow you to kill the processing that has the lock as well.

Additionally, it offers actions to do to the locked file in question such as deleting it.

Unlocker helps delete locked files with error messages including «cannot delete file,» and «access is denied.» Video tutorial available.

Some errors you might get that Unlocker can help with include:

• Cannot delete file: Access is denied.
• There has been a sharing violation.
• The source or destination file may be in use.
• The file is in use by another program or user.
• Make sure the disk is not full or write-protected and that the file is not currently in use.

Find out which process is locking a file or folder in Windows

How can I find out which process is locking a file or folder in Windows?

For instance, when trying to delete a folder, Windows reports this:

The action can’t be completed because the folder is open in another program

Happens the same with a file, but how do I find out what program or application is currently using it and preventing me from deleting the file or folder?

11 Answers 11

The openfiles command needs to have support for local files enabled, by running openfiles /local on and restarting.

You can use the Resource Monitor for this which comes built-in with Windows 7, 8, and 10.

1. Open Resource Monitor, which can be found
   • By searching for Resource Monitor or resmon.exe in the start menu, or
   • As a button on the Performance tab in your Task Manager
2. Go to the CPU tab
3. Use the search field in the Associated Handles section
   • See blue arrow in screen shot below

When you’ve found the handle, you can identify the process by looking at the Image and/or PID column.

You can then try to close the application as you normally would, or, if that’s not possible, just right-click the handle and kill the process directly from there. Easy peasy!

A couple of options:

Microsoft/SysInternals Process Explorer — Go to Find > Find Handle or DLL. In the «Handle or DLL substring:» text box, type the path to the file (e.g. «C:\path\to\file.txt») and click «Search». All processes which have an open handle to that file should be listed.

WhoLockMe — Explorer extension which adds a right-click menu option

N.B. WhoLockMe appears to not work with Win 10 (at least I have been unable to register it with either of the 32- or 64-bit versions of regsvr32.exe).

Have a look at Process Explorer ( procexp.exe ).

From its introduction:

Ever wondered which program has a particular file or directory open? Now you can find out.

To find out what process is using a specific file follow these steps:

Go to Find, Find Handle or DLL.. or simply press Ctrl + F .

Enter the name of the file and press Search.

Process Explorer will list all processes that have a handle to the file open. Click on an entry to focus the process in the main window.

Optionally, you can then even close the handle manually through the lower pane ( Ctrl + L ):

LockHunter can unlock any handlers that may have locked your files or folders. Unlike similar freewares, it supports both 32 and 64-bit Windows.

It is a free tool to delete files blocked by something you do not know. LockHunter is useful for fighting against malware, and other programs that are blocking files without a reason. Unlike other similar tools it deletes files into the recycle bin so you may restore them if deleted by mistake.

• Shows processes locking a file or folder
• Allows to unlock, delete, copy or rename a locked file
• Allows to kill locking process
• Allows to remove locking processes from hard drive
• Integrates in to Explorer menu
• It deletes files into the recycle bin, so you may restore them if deleted by mistake
• Supports both 32 and 64bit Windows

EMCO UnlockIT can identify the process that has locked the file as well as unlock the file so that you may delete/edit/move it. The program is completely free, though the newer version is a bit slower and more bloated than the original (which had a plain, unskinned GUI, but loaded pretty much instantaneously and without an annoying splash screen). Also, the original version used to pop up automatically whenever the error you mentioned is triggered, allowing you to instantly unlock the file and perform the operation you were attempting.

Still, UnlockIT is an incredibly useful program that provides a basic functionality that is critically missing from Windows. It’s among the standard toolkit of utilities that I install on all Windows computers I work on.

A lot of the programs here are outdated. I finally ended up using nirsoft’s OpenedFilesView which worked really well.

Though the best part is the explorer menu integration, which is easy to enable. As per website

Starting from version 1.10, you can launch OpenedFilesView directly from Windows Explorer, and view only the handles of the file or folder that you want to inspect. In order to enable this feature, check the ‘Enable Explorer Context Menu’ under the Options menu. After you enable this feature, you can right-click on any file or folder on Windows Explorer, and choose the ‘OpenedFilesView’ item from the menu. If you run the OpenedFilesView option for a folder, it’ll display all opened files inside that folder. If you run the OpenedFilesView option for a file, it’ll display all opened handles for that file.

Find out who is locking a file on a network share

I want to known who is locking a file on a network share.

Here is the problem : the network share is on a NAS, so I can’t log on. I need a tool to find out remotely who is locking the file. It is not practical to reboot the NAS every time, because there are several users.

Handle.exe, Process Explorer and PsFile seems to be limited to files on the local machine, so they don’t work for me.

8 Answers 8

Just in case someone looking for a solution to this for a Windows based system or NAS:

There is a built-in function in Windows that shows you what files on the local computer are open/locked by remote computer (which has the file open through a file share):

• Select «Manage Computer» (Open «Computer Management»)
• click «Shared Folders»
• choose «Open Files»

There you can even close the file forcefully.

On Windows 2008 R2 servers you have two means of viewing what files are open and closing those connections.

Via Share and Storage Management

Server Manager > Roles > File Services > Share and Storage Management > right-click on SaSM > Manage Open File

Via OpenFiles

CMD > Openfiles.exe /query /s SERVERNAME

PsFile does work on remote machines. If my login account already has access to the remote share, I can just enter:

(replace «remote-share» with the name of your file server) and it will list every opened document on that share, along with who has it open, and the file ID if I want to force the file closed. For me, this is a really long list, but it can be narrowed down by entering part of a path:

This is kind of tricky, since in my case this remote share is mounted as Z: on my local machine, but psfile identifies paths as they are defined on the remote file server, which in my case is I: (yours will be different). I just had to comb through the results of my first psfile run to see some of the paths it returned and then run it again with a partial path to narrow down the results.

Optionally, PsFile will let you specify credentials for the remote share if you need to supply them for access.

Lastly, a little known tip: if someone clicks on a file in Windows Explorer and cuts or copies the file with the intent to paste it somewhere else, that act also places a lock on the file.