Share this question

Welcome to Teachnovice Q&A, where you can ask questions and receive answers from other members of the community.

This is a collaboratively edited question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

How do you find what process is holding a file open in Windows?

0 like 0 dislike
173 views

One thing that annoys me no end about Windows is the old sharing violation error. Often you can't identify what's holding it open. Usually it's just an editor or explorer just pointing to a relevant directory but sometimes I've had to resort to rebooting my machine.

Any suggestions on how to find the culprit?

asked Aug 13, 2016 by cletus  

6 Answers

0 like 0 dislike

I've used Handle with success to find such processes in the past.

answered Oct 19, 2016 by Greg Hewgill  
0 like 0 dislike

I've had success with Sysinternals Process Explorer. With this, you can search to find what process(es) have a file open, and you can use it to close the handle(s) if you want. Of course, it is safer to close the whole process. Exercise caution and judgement.

To find a specific file, use the menu option Find->Find Handle or DLL... Type in part of the path to the file. The list of processes will appear below.

If you prefer command line, Sysinternals suite includes Handle, that lists open handles. A few examples on how to use it:

  • c:\Program Files\SysinternalsSuite>handle.exe |findstr /i e:\ - find all files opened from drive E:
  • c:\Program Files\SysinternalsSuite>handle.exe |findstr /i file-or-pathi-in-question
answered Oct 19, 2016 by Eddie  
0 like 0 dislike

Just be very careful with closing handles; it's even more dangerous than you'd think, because of handle recycling - if you close the file handle, and the program opens something else, that original file handle you closed may be reused for that "something else." And now guess what happens if the program continues, thinking it is working on the file (whose handle you closed), when in fact that file handle is now pointing to something else.

see Raymond Chen's post on this topic

Suppose a search index service has a file open for indexing but has gotten stuck temporarily and you want to delete the file, so you (unwisely) force the handle closed. The search index service opens its log file in order to record some information, and the handle to the deleted file is recycled as the handle to the log file. The stuck operation finally completes, and the search index service finally gets around to closing that handle it had open, but it ends up unwittingly closing the log file handle.

The search index service opens another file, say a configuration file for writing so it can update some persistent state. The handle for the log file gets recycled as the handle for the configuration file. The search index service wants to log some information, so it writes to its log file. Unfortunately, the log file handle was closed and the handle reused for its configuration file. The logged information goes into the configuration file, corrupting it.

Meanwhile, another handle you forced closed was reused as a mutex handle, which is used to help prevent data from being corrupted. When the original file handle is closed, the mutex handle is closed and the protections against data corruption are lost. The longer the service runs, the more corrupted its indexes become. Eventually, somebody notices the index is returning incorrect results. And when you try to restart the service, it fails because its configuration files have been corrupted.

You report the problem to the company that makes the search index service and they determine that the index has been corrupted, the log file has mysteriously stopped logging, and the configuration file was overwritten with garbage. Some poor technician is assigned the hopeless task of figuring out why the service corrupts its indexes and configuration files, unaware that the source of the corruption is that you forced a handle closed.

answered Oct 19, 2016 by Mark Sowul  
0 like 0 dislike

For Windows 7 and Windows 8 you can use the built-in Resource Monitor for this.

  1. Open Resource Monitor, which can be found
    • By searching for resmon.exe in the start menu, or
    • As a button on the Performance tab in your Task Manager
  2. Select the check box next to the Image heading on the Processes section (The checked processes will display their file handles below.)
  3. Use the search field in the Associated Handles section on the CPU tab
    • Pointed at by blue arrow in screen shot below

In case it's not obvious, when you've found the handle, you can identify the process by looking at the Image and/or PID column.

You can then close the application if you are able to do that, or just right-click the row and you'll get the option of killing the process right there. Easy peasy!

Resource Monitor screenshot

answered Oct 19, 2016 by Svish  
0 like 0 dislike

A couple of options:

Microsoft/SysInternals Process Explorer - Go to Find > Find Handle or DLL. In the "Handle or DLL substring:" text box, type the path to the file (e.g. "C:\path\to\file.txt") and click "Search". All processes which have an open handle to that file should be listed.

WhoLockMe - Explorer extension which adds a right-click menu option

N.B. WhoLockMe appears to not work with Win 10 (at least I have been unable to register it with either of the 32- or 64-bit versions of regsvr32.exe).

answered Oct 19, 2016 by Shevek  
0 like 0 dislike

Have a look at Process Explorer (procexp.exe).

From its introduction:

Ever wondered which program has a particular file or directory open? Now you can find out.

To find out what process is using a specific file follow these steps:

  1. Go to Find, Find Handle or DLL.. or simply press Ctrl+F.

    Enter image description here

  2. Enter the name of the file and press Search.

    Enter image description here

  3. Process Explorer will list all processes that have a handle to the file open. Click on an entry to focus the process in the main window.

    Enter image description here

  4. Optionally, you can then even close the handle manually through the lower pane (Ctrl+L):

    Enter image description here

answered Oct 19, 2016 by Eroen  
...