How can I find out who is using a “file in use”?

Windows will often report that a file is in use without telling you what program is using it. Process Explorer can tell you.

//

How can I find out who is using a “file in use”?

The scenario typically looks like this: you want to delete, move, or rename a file, or maybe even just use it in another application and you get a message that says you can’t. The message indicates that another application is using the file.

Great. “What application?” you ask.

It wouldn’t be that hard for Windows to tell you, but as it doesn’t, you’ll need to do a little investigatory work yourself. Fortunately, there’s a free tool.

When I’m faced with this situation, I grab my copy of SysInternals procexp.exe, a very nifty tool that does exactly what we need here (and a whole lot more). In a nutshell, Procexp is Task Manager on steroids. I’ve referenced it in several answers as a great tool to use to see what’s running on your system. However it’s also a great tool to see who’s got that file open.

Let’s assume that I’m trying to find out who has my mail folder open. In my case, that’s the file “personal.pst”. I’ll run procexp and select Find, Find Handle…. (Every object such as an open file is identified by a unique number called a “handle” – procexp searches across all those objects, not just the files.) I’ll enter in personal.pst and procexp will respond something much like this:

OUTLOOK.EXE        2956   C:xferMAILpersonal.pst
OUTLOOK.EXE        2956   C:xferMAILpersonal.pst
OUTLOOK.EXE        2956   C:xferMAILpersonal.pst

Sure enough, as we might expect in this case, Outlook has the file open.

If you’re networked, there’s another situation that might need an additional step. For example, I keep my email archives on a server so we’ll look on that server to see who has a past year’s archives, 2004.pst, open. On the server, I’ll use procexp as before to see who has 2004.pst open and the results will look much like this:

System             4      C:adminmail2004.pst

OK, now that didn’t help much. “System” is just that; the operating system. In this case, it’s probably the networking component of the system that manages file access from remote users. So who’s the remote user opening the file?

This one’s easy, and the tools are already on your machine. On the server, right-click on My Computer, then select Manage, expand Shared Folders, and click on Open Files. There you’ll see a list of files on the server that are currently opened by other computers on your network. That’ll tell you the User who has the file open. You’ll need to then click on Sessions to see what computers that user is connecting from. In my case, 2004.pst is in use by my laptop. So I’ll head over to my laptop, once again run procexp, and this time search for 2004.pst there. The results:

OUTLOOK.EXE        2956   DeviceLanmanRedirectorleomail2004.pst
OUTLOOK.EXE        2956   DeviceLanmanRedirectorleomail2004.pst
OUTLOOK.EXE        2956   DeviceLanmanRedirectorleomail2004.pst

Sure enough, Outlook running on my laptop has 2004.pst open (three times, again – that’s just an Outlook artifact). In this case, you can see it’s via something called the ”LanmanRedirector” which is the part of Windows’ networking software on my laptop that handles requests for files that are located across the network.

So, for simple “Who’s using this file?” inquiries, procexp is a one-stop answer. If the network is involved, it might take an additional step or two.

But the answers are definitely out there.

There are 45 comments:

  1. Camcuru Reply

    Ok, so now that we know who has the file opened, how can we force them to release it ?
    Specially when the file lives on a remote server and the local holder of the handle is a long dead copy of Outlook.
    (System crashed because of some worm and Outlook never released the file handle even after several reboots.)

    Camcuru

  2. Leo Reply

    Well, a reboot releases ALL file handles, so apparently something is starting on each reboot that is re-accessing the file.

    On the server you can, in a command shell, type “NET FILE” to see what’s open. Each will have a number, and then you can “NET FILE id /CLOSE” where id is that number, to force the file closed.

    Good luck!

  3. Abel Reply

    Somehow or another it says that one of my movie files is being used by explorer.exe and thats why i cant move/rename/delate it. I’ve a couple times and virus-scanned with no results. Any ideas?

  4. Leo Reply

    Even after a reboot? If so, I’m kind of at a loss. It’s not referenced in your startup is it? Can you share the specific location and name of the file on your machine, or where it came from?

  5. Simcha Reply

    If you can’t move a file even after a reboot because its in use, there is a free utility available from Microsoft that may help. INUSE.exe allows you to schedule a file replace for the next reboot (you could do this yourrself in the registry, but inuse is neater). However, it doesn’t seem to provide a way to copy the file before it’s renamed. Here’s where to find it:

  6. Fugu Reply

    Abel: I’ve bumped in to the same problem. The only way I could do it was to first kill explorer.exe process using Task Manager and then rename the movie file using command prompt. After that you can run explorer.exe again.

  7. cacona666 Reply

    Is there any utility to know automatically before shutting down that there are some files in use (as in Windows 98, that the OS shows a warning that there are “connected” users).

    Thanks,
    Juan Carlos

  8. Leo Reply

    Not off hand. The problem is that there are *always* files in use. By the operating system, if nothing else. If you’re worried specifically about files being used on that machine from other machines on the network, you could go into a command shell and type “Net File” to see what’s been opened remotely.

  9. Bernd Wechner Reply

    What if I’m using a file on a the network (on a remote share) which is locked? How can I tell who has that locked?

  10. Leo Reply

    That was covered in the article. But you *do* need access to the server.

  11. Mark Reply

    I often need to know which users are using a file located on a server. Once I know who thay are, I can phone then to close it, or in their absence, I would like to be able to close it. (winfile had this feature, unfortunetly it doesn’t work with win2K)

  12. David Rollinson Reply

    This is probably a bit late for you, but saw your question about how to determine what files are open on a network server, so that you can shutdown without files still open. I’ve had this issue too, and just discovered how to solve it… at least in WIN98.

    Double click on Network Neighbourhood on your desktop
    R-click on the Server name, and choose properties
    Click on the Tools tab
    Click on Net Watcher

    and there you can see a list of all files open

    Hope this helps
    David

  13. fulton74 Reply

    I can tell you why the system is ‘using’ the movie file (or other large media files). By default, windows attemts to preview the file in the open window. In the case of a large file, or (in the case of Microsoft codec encoded mpeg/avi files) the file has to be locked for the preview to work. Turn off preview of multimedia files in the explorer options.

  14. omg Reply

    “The only way I could do it was to first kill explorer.exe process using Task Manager and then rename the movie file using command prompt. After that you can run explorer.exe again.”

    How the heck do you use the command prompt?? Once you get rid of explorer, everything disappears.

  15. Richard Reply

    Easily.. Keyboard shortcuts would still work:
    [windows key] + R
    cmd

    voila, command prompt!

  16. Tom Reply

    Thank you for the clues. Using SysInternals’ tool allowed me to find out that it was the infernal MusicMatch program mim.exe that had its mitts on my external disk, not allowing me to “Safely Remove Hardware”. I just searched for “e:” and the finger pointed.

  17. monty Reply

    I try to edit an MP3 Tag using the advanced properties tab in Windows XP and I keep getting an error that says “Change to summary properties could not be saved. The file is in use by another application.” I have tried to use your your suggestions and the program Process Explorer listed in this article with no success. If I don’t know the name of the actual file that is in use, how do I do a search using this program. What am I missing. Please help, Thanks. MC

  18. Kathi Reply

    I FOUND THIS FILE (something I assume I downloaded and saved), but I have no idea what it is for: LEO_ Setup – OUTLOOK.EXE
    After going through several internet searches, I arrived at your web site and it seems plausible that I may have found it here. I don’t know and I hesitate to open the file, as I don’t know what it is. Do you recognize it? Thanks

  19. Leo Notenboom Reply

    I do not recognize it. Not sure at all what it might be.

  20. Caroline Reply

    Hi, the other day I noticed the my MSN messenger no longer had my conversations from a couple of months ago saved. So I tried to see if I could restore them. When I ran the system restore I noticed that my web cam software I had just installed two days ago was no longer installed. So I tried to install it again but the installation would freeze all the time. My antivirus wouldn’t work either. Anyway, I ran the system restore back to the day after I had my web cam installed. The antivirus and cam were working again, but everytime I started my computer a window would pop up saying that there was a run error with one of my web cam’s software because it was missing a”-” on the app id. I tried to uninstall the web cam but it wouldn’t do it completely. It wouldn’t erase the one software with the running error. Anyway, I ran the restore again and had to re-install my anti virus. I also tried to defrag my computer and when it came to 50% it said it couldn’t defrag some files. The computer does not accuse having the web cam installed right now, but I don’t know that if I try to re-install it I’ll run into the same problem again. Also, could it be that the disk defragger is not defragmenting all the way because of all the problems I had above? What do I do?

  21. bluefalcon Reply

    I have used that and discoverd that a certain trojan (deluxe communications) is not actually in use, though it claims to be and prevents me or anything else from changing it even when using MoveOnBoot or DelLater.

  22. jcoll Reply

    Thanks for the advice. Here we have a similar set up, where we have the users archive their PST files on to our server. I am trying to allow two users to access an old employees archived .pst, but when I try and add the pst to the user’s account it says it is in use by the other user. It only allows one user to access the .pst at a time. Is there a way around this?

  23. Leo A. Notenboom Reply

    No. Outlook does not allow multiple simultaneous access of PST files.

  24. Andrew Reply

    Thanks! – Although procexp.exe helped me to find the culprit that had the file open… It strangely did not report that *anything* directly had the file open(!?) — I basically saw that the Logitech Webcam tray app had a number of other mapi files open, and this was a mapi dll, so I killed the Logitech process and was finally able to delete the file.

  25. Rod Nolan Reply

    unlocker is the simplest (and therefore the best) utility I’ve found for deleting files and folders when that annoying “in use” message appears – you don’t even have to kill the process to unlock the file. And it’s free! http://ccollomb.free.fr/unlocker/

  26. Eamann Reply

    I have a trojan on my computer that various anti virus programs can detect but not delete. it is a windows system32 dll file that can’t be deleted manually. Is there anyway to remove it. Also the link for SysInternals just takes me to massive microsoft site

  27. rafaelpdl Reply

    Hi Leo, I’m trying to rename a file that is on one of the servers, but it gives this damn message, but I’m not authorized to send applications in the servers to do this analysis, so, here is the question. There is some way to discover what program is using the file, or a software that remotely do this job??

    Thanks for your attention.

  28. JM Reply

    Hi Leo,

    I am dealing with an Ad-Ware virus detected by Avast. It appears that the infected files are generated on the fly by.

    For instance Avast reports a virus detection for
    C:WINDOWSsystem32xxywVOfC.dll
    Even if I delete this file it comes back at a later time. I also have performed a boot time complete virus scan on the disk and the virus remains.

    I have run find handle using ProcessExplorer for this file and it reports the following:
    winlogon.exe 1688 DLL C:WINDOWSsystem32xxywVOfC.dll
    winlogon.exe 1688 handle C:WINDOWSsystem32xxywVOfC.dll
    Explorer.exe 3140 DLL C:WINDOWSsystem32xxywVOfC.dll

    Is there a way I can find which process is generating these files?
    Could it be that the virus is within either winlogon.exe or Explorer.exe?

    Thanks
    JM

  29. Barbara Feldman Reply

    Thanks for the procexp.exe tip. It helped me track down a pesky WordPerfect problem, when some of my most used files were giving me the “must be read-only or in use” error. When procexp.exe told me it was WordPerfect that had the files open, I realized that I had two WordPerfect processes open (one must have failed days ago…)

    Ta da! Problem solved by opening the Windows Task Manager and killing the duplicate WordPerfect process.

  30. Tawrrna Wynne Reply

    My disk defrag from windows xp does not seem to working because I it says my hard drive is full. I dnt download music, movies etc just the internet.

    Anyway I have reset the computer but it seems to develop another problem. it gives me some code like walpnil.exe. the computer is slower than ever. I notice this after yahoo messenger. Which i have taken off. However, it states when I try to defrag that I have no space (7%) when I need 15%. can you advise me.

  31. Sam Reply

    Thanks for the info. Process xp does help, but doesn’t close the handle even if forced. I tried deleting a few files which were showing error but it didn’t. Same is the case with unlocker, mentioned by a reader earlier. Nothing happens when i click on unlock all. Plz tell something else.

    Don’t use process explorer to close the handle. Use it to identify the process that has the handle, and then close that program.

    - Leo
    27-Mar-2009
  32. Dan Aquinas Reply

    A simple command line utility, also by the SysInternals.com folks, is Handles. Just type in
    Handles {{filename_may_include_path}}
    and it shows which process has the file open. Worked great for me on my local hard drive. Have not tried on a file located on a server.

    (- Microsoft has bought SysInternals.com, so entering http://www.sysinternals.com or sister site http://www.wininternals.com will actually take you to Microsoft’s site. -)

  33. Matt Reply

    So far, this is a glorified task manager. This does not locate files, handles, dll or anything. I’m simply tring to find out what file is being used by what mysterious process – and this cannot locate it. I hope Microsoft didn’t pay too much for this.

  34. Core Reply

    @ Matt
    Then your doing it wrong, it works fine for me. I just used it to make cfp.exe stop using a folder so I could delete it. (cfp.exe is comodo firewall, btw).

    To find out what file is being used by what, you simple go to find -> “Handle or DLL…” (or just hit CTRL+F), and then type in the file or folder you want to see and hit search.

    It works fine for me. It really is not that complicated….

  35. Ahmed Hawsawi Reply

    Thanks for the tool, but I really need it because when I attempt to download it, I’ve got a message telling the file already removed.

    Can anyone provide me the specific file PLS ??

    Thanks for the support..

  36. Ashley Reply

    In Windows you can just use the Computer Management program for this from the control panel. Start –> Control Panel –> Administrative Tools –> Computer Management. Expand the Shared Folders Folder and then double click the Open Files folder. This lists all files currently open by either networked machines or the system. You can force the file to be closed from here too.

  37. nineowls Reply

    Thanks for the refresher course on handles in sysinternals procexp. I spent half a work day searching Microsoft kb without success, but this solution for deleting a file and a folder that windows explorer had locked up just worked!!

  38. Csongi bacsi Reply

    Leo, thanks, this is THE software what I was searhing for a long time. It solved my problem. Thank You! :)

  39. Bill April Reply

    I have many users who open files from the network and when they do they may get the message that it is in use but it often reports the wrong name. They are logged into the network and are using a mix of MS Office 2002, 2003(XP), or 2007. I am trying to find out what name Office uses to identify who has the file open.
    Any help is greatly appreciated!

    Typically it’s the login name of user of the machine that is running the copy of Word that has the file open.

    Leo
    10-Sep-2010

  40. Mark Reply

    Am I doing something wrong? I can’t update a client’s pc to XP SP3, with the error that volsnap.sys is in use. When I search for it, I get over hundreds of matching items. How do I find what process is locking the file?

Leave a reply:

Before commenting please:

  • Read the article. Seriously. You'd be shocked at how many people make comments that prove they didn't.
  • Comment only on the article. If you have a new, unrelated question start with the search box at the top of the page.
  • Don't post personal information. Email addresses, phone numbers and such will be removed.
  • Don't spam. Comments that look the least bit like spam will be removed.

Thanks!