…particularly when you have nothing open on that device.
I have some external hard drives that Windows 11 does not eject properly. This pop-up appears when nothing else is using it: “This device is in use. Close any programs that are using the device, then try again.”[/al_question]
Well, it’s not wrong. There is something using the device…
…it’s just not you. It’s also not obvious.
We need to dig a little deeper.
Become a Patron of Ask Leo! and go ad-free!
Ejecting when the device is currently in use
When trying to eject an external drive, Windows may claim it’s “in use” even when you’re not actively using it. Use Process Explorer from SysInternals to identify which programs or system processes are accessing the drive. Close those programs. If that’s not possible, unplugging it anyway is usually okay. Have backups just in case.
The error
You have connected an external drive to your computer. When you’re through using it and attempt to “Safely remove hardware” or right-click the drive in Windows File Explorer and click “Eject”, you get a pop-up message with the following text.
None of the programs you have running are accessing anything on the drive. From your perspective, the drive is most certainly not “in use”.
And yet Windows claims it is.
Because… it is.
Finding out who
If you haven’t already installed the SysInternals toolkit, I recommend you do so. For this problem, we’re going to use Process Explorer (not Process Monitor), which is one of those tools.
Run Process Explorer, and in its File menu, click on Show Details for All Processes.
Confirm a UAC prompt.
Now click on the Find menu and Find Handle or DLL… under that.
This will open a simple search box.
Enter the drive letter of the drive you’re attempting to eject, including the colon. In the example above, I’ve entered “D:”.
Click on Search and wait. This search can take a little time.
The results display the offending process(es) that are accessing the drive and preventing you from ejecting it.
Interpreting the results
There are several results that may appear, ranging from obvious to informative to completely unhelpful. While we hope not to see the latter, it happens.
Let’s explore the results from our example above.
cmd.exe
In my case, this is the obvious offender. In order to have something to find, I ran the Command Prompt and made “D:” the current drive and “Documents” the current folder. All I need to do is close Command Prompt and this usage will disappear.
svchost.exe
This is an example of a system service accessing the drive to perform its task. Svchost is just one example. Other common offenders here might include the search indexer or your anti-malware scanner.
The ideal solution is to wait until the service has done whatever it was doing. Eventually, the indexer will stop indexing or the scanner will complete its scan, and in both cases the drive will be released.
We’ll deal with the situation where that doesn’t happen (or you can’t wait) below.
System
This is similar to the system service we just discussed, except with less information. The only real information in the example above is that the “Name” field for the System process appears to indicate it has NTFS file system overhead information open; we don’t know why.
This means we have no clear solutions.
<Non-existant process>
This was new to me as I wrote this article. I believe it’s a process that had something open on the drive when the scan began, but the process itself terminated before the search results were displayed. But that’s just a theory.
Running the search again may or may not remove the item or replace it with a more easily identifiable culprit.
Then what?
If you gather enough information from what we just did to be able to close a program or wait for something to complete, then retry your Safely Remove Hardware or Eject command. If it works, you’ve resolved your issue.
If, however, the message persists, you have two options.
Option #1: The completely 100% safe option.
- Shut down your machine.
- Remove the device.
- Restart your machine.
But… what a pain, particularly if this happens often.
Option #2: The pragmatic, almost-always-safe option.
Using Process Explorer as we have above, confirm that the drive isn’t being used for anything.
Then unplug it anyway.
Particularly in recent versions of Windows, external drives automatically have “quick removal” enabled. This means that it’s almost always safe to unplug the device. The only practical risk is if you’re writing to it heavily at the time, and using Process Explorer, we’ve done our best to ensure that’s not happening.
I have to stress that there’s no guarantee this will work out okay, and you should, of course, always have your data backed up.
But pulling the plug is almost always what I do myself.
Do this
Again, while there are no guarantees, it’s difficult to go wrong by pulling the plug on an external drive. Take the steps above to ensure the removal can happen safely or that the odds are greatly in your favor if it can’t.
Subscribe to Confident Computing! Less frustration and more confidence, solutions, answers, and tips in your inbox every week.
From what I understand, if you pull the plug while a file is being written to, the worst that can happen is that you’ll lose the data that’s being copied or moved to the drive and possibly corrupt the files you are writing to. Not a good thing, but not a disaster either.
Incorrect. While highly unlikely a pulled plug at exactly the wrong time could mess up the entire drive. (Basically a bad write to something like the root folder, or overhead files, or who knows what). Highly likely to be recoverable using appropriate tools, but could affect much more than just the single file you were working on.
When I encounter this issue, I shut down the computer, remove the USB device, then restart the system. I know that Windows will always flush any caches in use when it shuts down, so all data is protected, and the drive can be safely removed while the system is off. How you handle such an issue is up to you,
Ernie
Rather than shutting all the way down, would merely logging out suffice? That would do much the same thing, terminating all currently running user-account related processes. Shouldn’t that be enough…?
In most cases, that should work. There are rare situations when a process is using the drive that’s outside your logged in session, so there’s still a risk however small.
When a restart is called for, for example, when I install or update a program that requires a restart, I log out of my session. If that doesn’t work, I’d restart. So far, I’ve never had to restart. I do restart when Windows updates.
It is not mentioned in your article nor in any comments, so I am concerned that I may have a product that I should not be using to solve this issue. It is a program I found years ago called ‘USB Safe Removal’, which sits in the tray of my computer. When I plug a drive in, it tells me it is there and what drive letter it is using. When I want to remove the drive, it organises it for me. If there is a program accessing or locking it, a list is presented to me, and it awaits my decision on whether it should force closure or not. It does other things as well, but that is outside the scope of this comment. To date, I have not had an issue, but I am no computer expert. I do rely on what wisdom comes from sites like yours, ones I have learned to trust over the years.