How can I find out which process is locking a file or folder in Windows?
For instance, when trying to delete a folder, Windows reports this:
The action can't be completed because the folder is open in another program
It also happens with files.
How do I find out what program or application is currently using it and preventing me from deleting the file or folder?
You can use the Resource Monitor for this which comes built-in with Windows 7, 8, 10 and 11!
When you've found the handle, you can identify the process by looking at the Image and/or PID column.
You can then try to close the application as you normally would, or, if that's not possible, just right-click the handle and kill the process directly from there. Easy peasy!
A couple of options:
Microsoft/SysInternals Process Explorer - Go to Find > Find Handle or DLL. In the "Handle or DLL substring:" text box, type the path to the file (e.g. "C:\path\to\file.txt") and click "Search". All processes which have an open handle to that file should be listed.
WhoLockMe - Explorer extension which adds a right-click menu option
N.B. WhoLockMe appears to not work with Win 10 (at least I have been unable to register it with either of the 32- or 64-bit versions of regsvr32.exe).
Have a look at Process Explorer (procexp.exe).
From its introduction:
Ever wondered which program has a particular file or directory open? Now you can find out.
To find out what process is using a specific file follow these steps:
Go to Find, Find Handle or DLL.. or simply press Ctrl+F.
Enter the name of the file and press Search.
Process Explorer will list all processes that have a handle to the file open. Click on an entry to focus the process in the main window.
Optionally, you can then even close the handle manually through the lower pane (Ctrl+L):
PowerShell method:
if ((Test-Path -Path $FileOrFolderPath) -eq $false) {
Write-Warning "File or directory does not exist."
} else {
$LockingProcess = CMD /C "openfiles /query /fo table | find /I ""$FileOrFolderPath"""
Write-Host $LockingProcess
}
The openfiles command needs to have support for local files enabled, by running openfiles /local on and restarting.
More details How to find out which process is locking a file or folder in Windows archive
LockHunter can unlock any handlers that may have locked your files or folders. Unlike similar freewares, it supports both 32 and 64-bit Windows.
It is a free tool to delete files blocked by something you do not know. LockHunter is useful for fighting against malware, and other programs that are blocking files without a reason. Unlike other similar tools it deletes files into the recycle bin so you may restore them if deleted by mistake.
- Shows processes locking a file or folder
- Allows to unlock, delete, copy or rename a locked file
- Allows to kill locking process
- Allows to remove locking processes from hard drive
- Integrates in to Explorer menu
- It deletes files into the recycle bin, so you may restore them if deleted by mistake
- Supports both 32 and 64bit Windows
It does exactly what you are asking for.
ShowWhatProcessLocksFile is a lightweight and faster clone of File Locksmith that supports older versions of Windows.
EMCO UnlockIT can identify the process that has locked the file as well as unlock the file so that you may delete/edit/move it. The program is completely free, though the newer version is a bit slower and more bloated than the original (which had a plain, unskinned GUI, but loaded pretty much instantaneously and without an annoying splash screen). Also, the original version used to pop up automatically whenever the error you mentioned is triggered, allowing you to instantly unlock the file and perform the operation you were attempting.
Still, UnlockIT is an incredibly useful program that provides a basic functionality that is critically missing from Windows. It's among the standard toolkit of utilities that I install on all Windows computers I work on.
A lot of the programs here are outdated. I finally ended up using nirsoft's OpenedFilesView which worked really well.
Though the best part is the explorer menu integration, which is easy to enable. As per website
Explorer Context Menu
Starting from version 1.10, you can launch OpenedFilesView directly from Windows Explorer, and view only the handles of the file or folder that you want to inspect. In order to enable this feature, check the 'Enable Explorer Context Menu' under the Options menu. After you enable this feature, you can right-click on any file or folder on Windows Explorer, and choose the 'OpenedFilesView' item from the menu. If you run the OpenedFilesView option for a folder, it'll display all opened files inside that folder. If you run the OpenedFilesView option for a file, it'll display all opened handles for that file.
This tool still works reliably in 2019
If you do not know the program the file it is using then you can go to My Computer; right click; select Manage. Under System Tools > Shared folders > Open Files, you should be able to see the user who has locked the file. You can close file from here and then you can perform the task of rename or delete the file. Hope this helps
SysInternal's handle utility is designed exactly for this problem for the command line. Just execute the following:
handle -a path
Here is an example output:
→handle -a "C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db"
Nthandle v5.0 - Handle viewer
Copyright (C) 1997-2022 Mark Russinovich
Sysinternals - www.sysinternals.com
xplorer2_64.exe pid: 108904 type: File 844: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
xplorer2_64.exe pid: 108904 type: File 1098: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
xplorer2_64.exe pid: 108904 type: File 1B78: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
explorer.exe pid: 75252 type: File 2B68: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
explorer.exe pid: 75252 type: File 4B1C: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
firefox.exe pid: 20884 type: File 15A8: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
firefox.exe pid: 20884 type: File 3BF4: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
Additional possibility, just to save people the time I just spent:
In older versions of Windows, you might get "Access Denied - you might not have rights, or the file might be in use". If you find through Process Explorer that the files are, in fact, not opened by anyone, odds are that there is an issue with security. Using an administrator account, select the files in Explorer, right-click and select Properties, Security, Advanced, Owner. Odds are that the files are owned by an account that no longer exists or can no longer be verified to exist (because of changing Active Directory trust settings).
Change ownership to Administrators and you are good to go.
Here was my discovery & solution.
Incidentally, none of the above answers solved my problem.
I even tried using UNLOCKER which proved worthless.
My problem was that of Memeo Autosync Backup
Apparently, this backup process leaves enough of a "ghost like file." This "ghost like file," would show up whenever I would ALT-TAB my computer (Windows Professional XP), i.e. I would see TWO MS Excel Programs running, when I only had ONE visible, on my TASK BAR.
I came across this solution when I thought it might have been the SYMANTEC Endpoint (Anti-Virus) Protection; and disabled the program. However, I kept getting the error message:
cannot delete (LARGE.xls file): It is being used by another person or program. Close any programs that might be using this file and try again.
I subsequently kept seeing the Memeo notice of "syncing" and QUIT the program.
Subsequently, NO ERROR.
For you, it could be ANY of these background saves.
You can also do it programmatically by leveraging on the NTDLL/KERNEL32 Windows API. E.g. have a look at the following code in Python which returns a list of PIDs that can then easily be killed using the Task Manager or similar tools.
import ctypes
from ctypes import wintypes
path = r"C:\temp\test.txt"
-----------------------------------------------------------------------------
generic strings and constants
-----------------------------------------------------------------------------
ntdll = ctypes.WinDLL('ntdll')
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)
NTSTATUS = wintypes.LONG
INVALID_HANDLE_VALUE = wintypes.HANDLE(-1).value
FILE_READ_ATTRIBUTES = 0x80
FILE_SHARE_READ = 1
OPEN_EXISTING = 3
FILE_FLAG_BACKUP_SEMANTICS = 0x02000000
FILE_INFORMATION_CLASS = wintypes.ULONG
FileProcessIdsUsingFileInformation = 47
LPSECURITY_ATTRIBUTES = wintypes.LPVOID
ULONG_PTR = wintypes.WPARAM
-----------------------------------------------------------------------------
create handle on concerned file with dwDesiredAccess == FILE_READ_ATTRIBUTES
-----------------------------------------------------------------------------
kernel32.CreateFileW.restype = wintypes.HANDLE
kernel32.CreateFileW.argtypes = (
wintypes.LPCWSTR, # In lpFileName
wintypes.DWORD, # In dwDesiredAccess
wintypes.DWORD, # In dwShareMode
LPSECURITY_ATTRIBUTES, # In_opt lpSecurityAttributes
wintypes.DWORD, # In dwCreationDisposition
wintypes.DWORD, # In dwFlagsAndAttributes
wintypes.HANDLE) # In_opt hTemplateFile
hFile = kernel32.CreateFileW(
path, FILE_READ_ATTRIBUTES, FILE_SHARE_READ, None, OPEN_EXISTING,
FILE_FLAG_BACKUP_SEMANTICS, None)
if hFile == INVALID_HANDLE_VALUE:
raise ctypes.WinError(ctypes.get_last_error())
-----------------------------------------------------------------------------
prepare data types for system call
-----------------------------------------------------------------------------
class IO_STATUS_BLOCK(ctypes.Structure):
class STATUS(ctypes.Union):
_fields = (('Status', NTSTATUS),
('Pointer', wintypes.LPVOID))
anonymous = 'Status',
_fields = (('_Status', _STATUS),
('Information', ULONG_PTR))
iosb = IO_STATUS_BLOCK()
class FILE_PROCESS_IDS_USING_FILE_INFORMATION(ctypes.Structure):
fields = (('NumberOfProcessIdsInList', wintypes.LARGE_INTEGER),
('ProcessIdList', wintypes.LARGE_INTEGER * 64))
info = FILE_PROCESS_IDS_USING_FILE_INFORMATION()
PIO_STATUS_BLOCK = ctypes.POINTER(IO_STATUS_BLOCK)
ntdll.NtQueryInformationFile.restype = NTSTATUS
ntdll.NtQueryInformationFile.argtypes = (
wintypes.HANDLE, # In FileHandle
PIO_STATUS_BLOCK, # Out IoStatusBlock
wintypes.LPVOID, # Out FileInformation
wintypes.ULONG, # In Length
FILE_INFORMATION_CLASS) # In FileInformationClass
-----------------------------------------------------------------------------
system call to retrieve list of PIDs currently using the file
-----------------------------------------------------------------------------
status = ntdll.NtQueryInformationFile(hFile, ctypes.byref(iosb),
ctypes.byref(info),
ctypes.sizeof(info),
FileProcessIdsUsingFileInformation)
pidList = info.ProcessIdList[0:info.NumberOfProcessIdsInList]
print(pidList)
Here is a full Powershell solution for that problem:
cls
remove-variable * -ea 0
$errorActionPreference = 'stop'
Add-Type -TypeDefinition @"
using System;
using System.IO;
using System.Runtime.InteropServices;
using Microsoft.Win32.SafeHandles;
public static class ProcessUtils {
[StructLayout(LayoutKind.Sequential)]
private struct IO_STATUS_BLOCK {
public IntPtr Information;
public IntPtr Status;
}
[StructLayout(LayoutKind.Sequential)]
public struct FILE_PROCESS_IDS_USING_FILE_INFORMATION {
public ulong NumberOfProcessIdsInList;
[MarshalAs(UnmanagedType.ByValArray, SizeConst = 64)]
public ulong[] ProcessIdList;
}
[DllImport("ntdll.dll")]
private static extern int NtQueryInformationFile(SafeFileHandle FileHandle, ref IO_STATUS_BLOCK IoStatusBlock,
IntPtr FileInformation, uint Length, int FileInformationClass);
[DllImport("kernel32.dll", SetLastError = true)]
private static extern SafeFileHandle CreateFile(string lpFileName, FileAccess dwDesiredAccess,
FileShare dwShareMode, IntPtr lpSecurityAttributes, FileMode dwCreationDisposition,
FileAttributes dwFlagsAndAttributes, IntPtr hTemplateFile);
public static ulong[] GetProcessesUsingFile(string filePath) {
var processIds = new ulong[0];
var ioStatusBlock = new IO_STATUS_BLOCK();
var fileInfo = new FILE_PROCESS_IDS_USING_FILE_INFORMATION();
using (var fileHandle = CreateFile(filePath, FileAccess.Read, FileShare.ReadWrite, IntPtr.Zero, FileMode.Open, 0, IntPtr.Zero)) {
if (!fileHandle.IsInvalid) {
var fileInfoPtr = Marshal.AllocHGlobal(Marshal.SizeOf(fileInfo));
var fileInfoSize = Marshal.SizeOf(fileInfo);
try {
int result = NtQueryInformationFile(fileHandle, ref ioStatusBlock, fileInfoPtr, (uint)fileInfoSize, 47);
if (result == 0) {
fileInfo = Marshal.PtrToStructure<FILE_PROCESS_IDS_USING_FILE_INFORMATION>(fileInfoPtr);
if (fileInfo.NumberOfProcessIdsInList > 0) {
processIds = new ulong[fileInfo.NumberOfProcessIdsInList];
Array.Copy(fileInfo.ProcessIdList, processIds, (int)fileInfo.NumberOfProcessIdsInList);
}
}
}
finally {
Marshal.FreeHGlobal(fileInfoPtr);
}
}
}
return processIds;
}
}
"@
Get processes using a file:
$file = 'c:\temp\test.txt'
[ProcessUtils]::GetProcessesUsingFile($file)
I am not sure if anyone used Process Viewer (PVIEW.exe). I was having trouble finding out the process that locked my epmd.exe which i was trying to delete, when I searched for Process Explorer app in my Windows 10 box - I found this app. So, I thought of giving it a try and it worked (so, this can be another option):
This app existed at the following location for me -
C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\Tools\PVIEW.EXE
Look for your locked application (file), and Kill Process to unlock the file.
225