How can I find out who is using a “file in use”?
The scenario typically looks like this: you want to delete, move, or rename a file, or maybe even just use it in another application and you get a message that says you can’t. The message indicates that another application is using the file.
Great. “What application?” you ask.
It wouldn’t be that hard for Windows to tell you, but as it doesn’t, you’ll need to do a little investigatory work yourself. Fortunately, there’s a free tool.
Become a Patron of Ask Leo! and go ad-free!
When I’m faced with this situation, I grab my copy of SysInternals procexp.exe, a very nifty tool that does exactly what we need here (and a whole lot more). In a nutshell, Procexp is Task Manager on steroids. I’ve referenced it in several answers as a great tool to use to see what’s running on your system. However it’s also a great tool to see who’s got that file open.
Let’s assume that I’m trying to find out who has my mail folder open. In my case, that’s the file “personal.pst”. I’ll run procexp and select Find, Find Handle…. (Every object such as an open file is identified by a unique number called a “handle” – procexp searches across all those objects, not just the files.) I’ll enter in personal.pst and procexp will respond something much like this:
OUTLOOK.EXE 2956 C:\xfer\MAIL\personal.pst OUTLOOK.EXE 2956 C:\xfer\MAIL\personal.pst OUTLOOK.EXE 2956 C:\xfer\MAIL\personal.pst
Sure enough, as we might expect in this case, Outlook has the file open.
If you’re networked, there’s another situation that might need an additional step. For example, I keep my email archives on a server so we’ll look on that server to see who has a past year’s archives, 2004.pst, open. On the server, I’ll use procexp as before to see who has 2004.pst open and the results will look much like this:
System 4 C:\admin\mail2004.pst
OK, now that didn’t help much. “System” is just that; the operating system. In this case, it’s probably the networking component of the system that manages file access from remote users. So who’s the remote user opening the file?
This one’s easy, and the tools are already on your machine. On the server, right-click on My Computer, then select Manage, expand Shared Folders, and click on Open Files. There you’ll see a list of files on the server that are currently opened by other computers on your network. That’ll tell you the User who has the file open. You’ll need to then click on Sessions to see what computers that user is connecting from. In my case, 2004.pst is in use by my laptop. So I’ll head over to my laptop, once again run procexp, and this time search for 2004.pst there. The results:
OUTLOOK.EXE 2956 \Device\Lanman\Redirector\leo\mail2004.pst OUTLOOK.EXE 2956 \Device\Lanman\Redirector\leo\mail2004.pst OUTLOOK.EXE 2956 \Device\Lanman\Redirector\leo\mail2004.pst
Sure enough, Outlook running on my laptop has 2004.pst open (three times, again – that’s just an Outlook artifact). In this case, you can see it’s via something called the “LanmanRedirector” which is the part of Windows’ networking software on my laptop that handles requests for files that are located across the network.
So, for simple “Who’s using this file?” inquiries, procexp is a one-stop answer. If the network is involved, it might take an additional step or two.
But the answers are definitely out there.
Ok, so now that we know who has the file opened, how can we force them to release it ?
Specially when the file lives on a remote server and the local holder of the handle is a long dead copy of Outlook.
(System crashed because of some worm and Outlook never released the file handle even after several reboots.)
—
Camcuru
Well, a reboot releases ALL file handles, so apparently something is starting on each reboot that is re-accessing the file.
On the server you can, in a command shell, type “NET FILE” to see what’s open. Each will have a number, and then you can “NET FILE id /CLOSE” where id is that number, to force the file closed.
Good luck!
Somehow or another it says that one of my movie files is being used by explorer.exe and thats why i cant move/rename/delate it. I’ve a couple times and virus-scanned with no results. Any ideas?
Even after a reboot? If so, I’m kind of at a loss. It’s not referenced in your startup is it? Can you share the specific location and name of the file on your machine, or where it came from?
If you can’t move a file even after a reboot because its in use, there is a free utility available from Microsoft that may help. INUSE.exe allows you to schedule a file replace for the next reboot (you could do this yourrself in the registry, but inuse is neater). However, it doesn’t seem to provide a way to copy the file before it’s renamed. Here’s where to find it:
Abel: I’ve bumped in to the same problem. The only way I could do it was to first kill explorer.exe process using Task Manager and then rename the movie file using command prompt. After that you can run explorer.exe again.
Is there any utility to know automatically before shutting down that there are some files in use (as in Windows 98, that the OS shows a warning that there are “connected” users).
Thanks,
Juan Carlos
Not off hand. The problem is that there are *always* files in use. By the operating system, if nothing else. If you’re worried specifically about files being used on that machine from other machines on the network, you could go into a command shell and type “Net File” to see what’s been opened remotely.
What if I’m using a file on a the network (on a remote share) which is locked? How can I tell who has that locked?
That was covered in the article. But you *do* need access to the server.
I often need to know which users are using a file located on a server. Once I know who thay are, I can phone then to close it, or in their absence, I would like to be able to close it. (winfile had this feature, unfortunetly it doesn’t work with win2K)
This is probably a bit late for you, but saw your question about how to determine what files are open on a network server, so that you can shutdown without files still open. I’ve had this issue too, and just discovered how to solve it… at least in WIN98.
Double click on Network Neighbourhood on your desktop
R-click on the Server name, and choose properties
Click on the Tools tab
Click on Net Watcher
and there you can see a list of all files open
Hope this helps
David
I can tell you why the system is ‘using’ the movie file (or other large media files). By default, windows attemts to preview the file in the open window. In the case of a large file, or (in the case of Microsoft codec encoded mpeg/avi files) the file has to be locked for the preview to work. Turn off preview of multimedia files in the explorer options.
“The only way I could do it was to first kill explorer.exe process using Task Manager and then rename the movie file using command prompt. After that you can run explorer.exe again.”
How the heck do you use the command prompt?? Once you get rid of explorer, everything disappears.
Easily.. Keyboard shortcuts would still work:
[windows key] + R
cmd
voila, command prompt!
Thank you for the clues. Using SysInternals’ tool allowed me to find out that it was the infernal MusicMatch program mim.exe that had its mitts on my external disk, not allowing me to “Safely Remove Hardware”. I just searched for “e:” and the finger pointed.
I try to edit an MP3 Tag using the advanced properties tab in Windows XP and I keep getting an error that says “Change to summary properties could not be saved. The file is in use by another application.” I have tried to use your your suggestions and the program Process Explorer listed in this article with no success. If I don’t know the name of the actual file that is in use, how do I do a search using this program. What am I missing. Please help, Thanks. MC
I FOUND THIS FILE (something I assume I downloaded and saved), but I have no idea what it is for: LEO_ Setup – OUTLOOK.EXE
After going through several internet searches, I arrived at your web site and it seems plausible that I may have found it here. I don’t know and I hesitate to open the file, as I don’t know what it is. Do you recognize it? Thanks
I do not recognize it. Not sure at all what it might be.
Hi, the other day I noticed the my MSN messenger no longer had my conversations from a couple of months ago saved. So I tried to see if I could restore them. When I ran the system restore I noticed that my web cam software I had just installed two days ago was no longer installed. So I tried to install it again but the installation would freeze all the time. My antivirus wouldn’t work either. Anyway, I ran the system restore back to the day after I had my web cam installed. The antivirus and cam were working again, but everytime I started my computer a window would pop up saying that there was a run error with one of my web cam’s software because it was missing a”-” on the app id. I tried to uninstall the web cam but it wouldn’t do it completely. It wouldn’t erase the one software with the running error. Anyway, I ran the restore again and had to re-install my anti virus. I also tried to defrag my computer and when it came to 50% it said it couldn’t defrag some files. The computer does not accuse having the web cam installed right now, but I don’t know that if I try to re-install it I’ll run into the same problem again. Also, could it be that the disk defragger is not defragmenting all the way because of all the problems I had above? What do I do?
I have used that and discoverd that a certain trojan (deluxe communications) is not actually in use, though it claims to be and prevents me or anything else from changing it even when using MoveOnBoot or DelLater.
Thanks for the advice. Here we have a similar set up, where we have the users archive their PST files on to our server. I am trying to allow two users to access an old employees archived .pst, but when I try and add the pst to the user’s account it says it is in use by the other user. It only allows one user to access the .pst at a time. Is there a way around this?
No. Outlook does not allow multiple simultaneous access of PST files.
Thanks! – Although procexp.exe helped me to find the culprit that had the file open… It strangely did not report that *anything* directly had the file open(!?) — I basically saw that the Logitech Webcam tray app had a number of other mapi files open, and this was a mapi dll, so I killed the Logitech process and was finally able to delete the file.
Other solutions…
The Windows Server 2003 Resource Toolkit comes with the console app OH.exe (open handles).
http://www.microsoft.com/downloads/details.aspx?FamilyID=9D467A69-57FF-4AE7-96EE-B18C4790CFFD&displaylang=en
WhoLockMe is a freeware GUI app.
http://www.dr-hoiby.com/WhoLockMe/index.php
unlocker is the simplest (and therefore the best) utility I’ve found for deleting files and folders when that annoying “in use” message appears – you don’t even have to kill the process to unlock the file. And it’s free! http://ccollomb.free.fr/unlocker/
I have a trojan on my computer that various anti virus programs can detect but not delete. it is a windows system32 dll file that can’t be deleted manually. Is there anyway to remove it. Also the link for SysInternals just takes me to massive microsoft site
Hi Leo, I’m trying to rename a file that is on one of the servers, but it gives this damn message, but I’m not authorized to send applications in the servers to do this analysis, so, here is the question. There is some way to discover what program is using the file, or a software that remotely do this job??
Thanks for your attention.
Hi Leo,
I am dealing with an Ad-Ware virus detected by Avast. It appears that the infected files are generated on the fly by.
For instance Avast reports a virus detection for
C:WINDOWSsystem32xxywVOfC.dll
Even if I delete this file it comes back at a later time. I also have performed a boot time complete virus scan on the disk and the virus remains.
I have run find handle using ProcessExplorer for this file and it reports the following:
winlogon.exe 1688 DLL C:WINDOWSsystem32xxywVOfC.dll
winlogon.exe 1688 handle C:WINDOWSsystem32xxywVOfC.dll
Explorer.exe 3140 DLL C:WINDOWSsystem32xxywVOfC.dll
Is there a way I can find which process is generating these files?
Could it be that the virus is within either winlogon.exe or Explorer.exe?
Thanks
JM
Thanks for the procexp.exe tip. It helped me track down a pesky WordPerfect problem, when some of my most used files were giving me the “must be read-only or in use” error. When procexp.exe told me it was WordPerfect that had the files open, I realized that I had two WordPerfect processes open (one must have failed days ago…)
Ta da! Problem solved by opening the Windows Task Manager and killing the duplicate WordPerfect process.
My disk defrag from windows xp does not seem to working because I it says my hard drive is full. I dnt download music, movies etc just the internet.
Anyway I have reset the computer but it seems to develop another problem. it gives me some code like walpnil.exe. the computer is slower than ever. I notice this after yahoo messenger. Which i have taken off. However, it states when I try to defrag that I have no space (7%) when I need 15%. can you advise me.
Thanks for the info. Process xp does help, but doesn’t close the handle even if forced. I tried deleting a few files which were showing error but it didn’t. Same is the case with unlocker, mentioned by a reader earlier. Nothing happens when i click on unlock all. Plz tell something else.
27-Mar-2009
A simple command line utility, also by the SysInternals.com folks, is Handles. Just type in
Handles {{filename_may_include_path}}
and it shows which process has the file open. Worked great for me on my local hard drive. Have not tried on a file located on a server.
(- Microsoft has bought SysInternals.com, so entering http://www.sysinternals.com or sister site http://www.wininternals.com will actually take you to Microsoft’s site. -)
So far, this is a glorified task manager. This does not locate files, handles, dll or anything. I’m simply tring to find out what file is being used by what mysterious process – and this cannot locate it. I hope Microsoft didn’t pay too much for this.
@ Matt
Then your doing it wrong, it works fine for me. I just used it to make cfp.exe stop using a folder so I could delete it. (cfp.exe is comodo firewall, btw).
To find out what file is being used by what, you simple go to find -> “Handle or DLL…” (or just hit CTRL+F), and then type in the file or folder you want to see and hit search.
It works fine for me. It really is not that complicated….
Thanks for the tool, but I really need it because when I attempt to download it, I’ve got a message telling the file already removed.
Can anyone provide me the specific file PLS ??
Thanks for the support..
Microsoft have published Process Explorer http://technet.microsoft.com/en-us/sysinternals/bb896653.aspx , can be downloaded for free. Seems that they don’t want
it to be avaliable anywhere else.
In Windows you can just use the Computer Management program for this from the control panel. Start –> Control Panel –> Administrative Tools –> Computer Management. Expand the Shared Folders Folder and then double click the Open Files folder. This lists all files currently open by either networked machines or the system. You can force the file to be closed from here too.
Thanks for the refresher course on handles in sysinternals procexp. I spent half a work day searching Microsoft kb without success, but this solution for deleting a file and a folder that windows explorer had locked up just worked!!
Leo, thanks, this is THE software what I was searhing for a long time. It solved my problem. Thank You! :)
I have many users who open files from the network and when they do they may get the message that it is in use but it often reports the wrong name. They are logged into the network and are using a mix of MS Office 2002, 2003(XP), or 2007. I am trying to find out what name Office uses to identify who has the file open.
Any help is greatly appreciated!
10-Sep-2010
Thank you Leo! Worked perfectly.
made my day! :)
Am I doing something wrong? I can’t update a client’s pc to XP SP3, with the error that volsnap.sys is in use. When I search for it, I get over hundreds of matching items. How do I find what process is locking the file?
Thank you for answering, but that didnt help
How is file in use found on a Mac?
You’d get a better answer to that question in a Mac forum.
Leo, I just subscribed less than 24 hours ago and have only read your material for about 6 hours, but I’ve learned the answers to more of my questions than in the last 10 years from all other sources. You’re a combination of one of my best friends in my area and the guy who’d worked in my section when I reported for my first full-time job: the best friend knows all the answers to Windows questions, but doesn’t work with me when my questions arise; and the guy who worked with me was there for me but didn’t know all the answers ’cause he’d been trained by my predecessor, and neither of them were IT (well, back in ’72, CS) students.
Now, if you just know Perl….
Well. I do. But it’s not a common enough topic to publish answers on. :-)
Hi Leo,
i created a bit locker key without a TPM using your instructions from a different post and it works great. Thanks.
on start up there is always something using it so i can`t safely remove the key.
i used procexp and there were a multitude of programs using it. but if i do a restart then i can safely
remove the key. after removing the key i went back to procexp and checked again and the same
programs are still using the key.
why can`t i remove the key the first time?
is it necessary to remove the key?