How to View and Close Open Files in Windows Server SMB Share?

Windows file server administrators often have to force close the shared files that are open simultaneously by multiple users. This usually happens if the desktop software doesn’t work as expected, the user logs off incorrectly, or when the user opened a file and forgot to close it (went home, on vacation, etc.). In all these cases, the file on the shared network folder is still open (and locked) and cannot be modified by other users. Other users can see such a message when trying to open a locked file (depending on the application used): The document filename is locked for editing by another user. To open a read-only copy of his document, click…

In this article we’ll show you how to get the list of open files on a Windows file server, find out which user locked a file on a shared folder, and how to close (reset) file sessions to unlock open files.

View Open Files on a Shared Network Folder on Windows Server

You can get the list of files opened by users on Windows file server using the built-in Computer Management ( compmgmt.msc ) graphic snap-in.

Open the Computer Management console on your file server (or connect to the server remotely from the management console running on your computer) and go to System Tools -> Shared Folders -> Open files. A list of open files on current SMB server is displayed on the right side of the window. The list contains the local path to the file, the name of the user account that opens the file, the number of locks and the mode in which the file is opened (Read or Write+Read).

You can get the same list of open files using the built-in openfiles.exe console tool. For example, using the following command you can get the Session ID, username and full local path to the open file:

openfiles /Query /fo csv |more

You can display a list of open files on a remote server. For example, you need to list all open files in shared folders on the lon-fs01 host:

openfiles /Query /s lon-fs01 /fo csv

How to Find Out Who is Locking a File in a Shared Folder?

To identify the user who opened (locked) the filename.docx file on the shared network folder on the remote server lon-fs01, run this command:

openfiles /Query /s lon-fs01 /fo csv | find /i «filename.docx»

You can specify only a part of the file name. For example, you need to find out who opened an XLSX file containing “sale_report” in its name. Use the following pipe:

openfiles /Query /s lon-fs01 /fo csv | find /i «sale_report»| find /i «xlsx»

Of course you can find this file in the Computer Management GUI, but it’s less convenient (this console doesn’t provide search feature).

How to Forcibly Close an Open File on a SMB Share?

To close an open file, find it in the list of files in Open File section and select Close Open File in the context menu.

If there are hundreds of open files on your file server, it won’t be easy to find the specific file in the console. It is more convenient to use the Openfiles command line tool. As we have already told, it returns the session ID of the open file. Using this session ID you can force close the file by resetting the SMB connection.

First, you need to find the session ID of the open file:

openfiles /Query /s lon-fs01 /fo csv | find /i «farm»| find /i «.xlsx»

Disconnect the user from file using the received SMB session ID:

openfiles /Disconnect /s lon-fs01 /ID 617909089

You can forcefully reset all sessions and unlock all files opened by a specific user:

openfiles /disconnect /s lon-fs01/u corp\mjenny /id *

Get-SMBOpenFile: Find and Close Open File Handlers Using PowerShell

New cmdlets to manage shares and files on an SMB server appeared in PowerShell version for Windows Server 2012/Windows 8. These cmdlets can be used to remotely close network connections to an open file.

You can get a list of open files using the Get-SMBOpenFile cmdlet. Close-SmbOpenFile is used to close/reset the connection to a remote file.

To display a list of open files on the Windows SMB server, run the command:

The command returns the file ID, session ID and full file name(path).
You can display a list of open files with user and computer names (IP addresses):

You can list all files opened by a specific user:

Get-SMBOpenFile –ClientUserName «corp\mjenny»|select ClientComputerName,Path

or from a specific computer/server:

Get-SMBOpenFile –ClientComputerName 192.168.1.190| select ClientUserName,Path

You can display a list of open files by pattern. For example, to list all exe files opened from the shared folder:

or open files with a specific name:

The Close-SmbOpenFile cmdlet is used to close the open file handler. You can close the file by ID:

Close-SmbOpenFile -FileId 4123426323239

But it is usually more convenient to close the file by name:

Get-SmbOpenFile | where <$_.Path –like "*annual2020.xlsx">| Close-SmbOpenFile -Force

With the Out-GridView cmdlet, you can make a simple GUI form for finding and closing open files. The following script will list open files. You should use the built-in filters in the Out-GridView table to find open files for which you want to reset the SMB sessions. Then you need to select the required files and click OK. As a result, the selected files will be forcibly closed.

Get-SmbOpenFile|select ClientUserName,ClientComputerName,Path,SessionID| Out-GridView -PassThru –title “Select Open Files”|Close-SmbOpenFile -Confirm:$false -Verbose

How to Close Open Files on Remote Computer Using PowerShell?

The Get-SMBOpenFile and Close-SmbOpenFile cmdlets can be used to remotely find and close open (locked) files. First, you need to connect to a remote Windows SMB server via a CIM session:

$sessn = New-CIMSession –Computername lon-fs01

The following command will find the SMB session for the open file pubs.docx and close the file session.

Get-SMBOpenFile -CIMSession $sessn | where <$_.Path –like "*pubs.docx">| Close-SMBOpenFile -CIMSession $sessn

Confirm closing of the file by pressing Y . As a result, you have unlocked the file. Now other users can open it.

With PowerShell, you can close SMB sessions and unlock all files that a specific user has opened (a user went home and didn’t release the open files). For example, to reset all file sessions of the user mjenny, run this command:

Get-SMBOpenFile -CIMSession $sessn | where <$_.ClientUserName –like "*mjenny*">|Close-SMBOpenFile -CIMSession $sessn

How to Identify which Windows Process is Locking a File or Folder

While attempting to delete, move, or rename a file or folder you get a Windows warning message; the Operating System refuses to complete the operation.

This article helps identifying the process that currently has a handle on the file or folder you are attempting a maintenance operation on.

Symptoms

When trying to delete, move, or rename a file you get a Windows system warning message:

• «Cannot delete file: Access is denied».
• «There has been a sharing violation».
• «The source or destination file may be in use».
• «The file is in use by another program or user».
• «Make sure the disk is not full or write-protected and that the file is not currently in use».

How to Solve the Issue

One of the easiest ways to handle locked files or folders is to use Microsoft Sysinternals Process Explorer.

Identify what program is using a file

Using Process Explorer there is a simple way to find the program:

1. Open Process Explorer
   • Running as administrator.
2. On the toolbar, find the gunsight icon on the right.
3. Drag the icon and drop it on the open file or folder that is locked.
4. The executable that is using the file will be highlighted in the Process Explorer main display list.

Identify which handle or DLL is using a file

1. Open Process Explorer
   • Running as administrator.
2. Enter the keyboard shortcut Ctrl+F.
   • Alternatively, click the “Find” menu and select “Find a Handle or DLL”.
3. A search dialog box will open.
4. Type in the name of the locked file or other file of interest.
   • Partial names are usually sufficient.
5. Click the button “Search”.
6. A list will be generated.
   • There may be a number of entries.

Release the lock on the file or folder

To release the lock on the file you are attempting the maintenance operation on, you will need to kill the appropriate process. An individual program or handle in the list provided by Process Explorer can be killed by:

1. Selecting the process/handle/program entry.
   
2. Pressing the delete key.

Proceed with care when deleting handles as this may generate erratic behavior and instabilities may occur.

How to view open files on Windows Server (2008, 2012 & 2016)

There are times when a file is open on a windows server and you need view what user or process has it open. These open files can be locked and prevent users from editing, cause errors when upgrading software, hold up a reboot and so on.

In this article, I will show you how to quickly view open files on windows server and workstations.

Both methods use built in Windows tools and works on most Windows versions (I’ve tested this on Server 2008, 2012, 2016 and Windows 10).

Video Tutorial

If you don’t like videos or want more details then continue reading.

Recommended Tool: SolarWinds Permissions Analyzer

Now you can quickly see WHO has permission to WHAT and answer the questions that suck up your time and patience.

SolarWinds FREE Permission Analyzer will determine a user’s effective NTFS permissions for a specific file, folder or network share access. The results are displayed in a nifty desktop dashboard.

Method 1: Use Computer Management to view shared files/folder

This first method is used to view open files on a shared folder. This is the best way to troubleshoot locked files that users have left open. If you need to see what process has a file open then check out method 2.

Step 1: Right Click the start menu and select Computer Management

Another way to access computer management is to type in compmgmt.msc into the start menu search box.

You will need to open up this console on the computer or server that has the shared folder. For example, I have a server called file1 with a shared folder named HR. To see the open files on this share I will need to open up the computer management console from the file1 server.

Step 2: Click on Shared Folders, then click on open files

I can now see that the user rallen has the HR folder and the file adpro.txt open.

If I needed to I can right click the file and select “Close Open File”. This is something that needs to be done when a file is locked.

That’s it for method 1.

If you need to check who has permissions to a file or folder then check out my guide How to view NTFS effective permissions.

Methods 2: See process and file details with Resource Monitor

Step 1: Type Resource monitor into the start menu search box

This is the quickest way to access the Resource Monitor.

Another option is to open up the task manager, click the performance tab and then click Open Resource Monitor.

Step 2: Click on the disk tab in resource monitor

Now that I have the resource monitor open I just need to click on the disk tab.

Now I can see all kinds of details about the disk activity such as files open, PID, read and write bytes per second and more.

You can move the columns around so you can see the full file path.

If have a lot of disk activity you go stop the live monitoring so you can view the open file activity.

To stop the live monitoring go to monitor, then select stop monitoring.

If you liked this article, then please subscribe to our YouTube Channel for more Active Directory Tutorials.

Recommended Tool: SolarWinds Server & Application Monitor

This utility was designed to Monitor Active Directory and other critical services like DNS & DHCP. It will quickly spot domain controller issues, prevent replication failures, track failed logon attempts and much more.

What I like best about SAM is it’s easy to use dashboard and alerting features. It also has the ability to monitor virtual machines and storage.