Find Which Process Has Locked a File Without 3rd Party Tools

When you attempt to delete a file or folder which is in use by a process, the File In Use dialog appears showing the name of the program that has locked the file. However, there are cases where the “File In Use” dialog doesn’t show the name of the process that has a lock on the file you’re trying to delete.

For investigating processes and locked files, Windows Sysinternals Process Explorer is probably the first option that comes to mind, for most users. There is, however, a built-in solution to display the current open files list along with corresponding process names.

Table of Contents

The built-in tool we’re going to use is Openfiles.exe, a console tool that’s not new to Windows, but originally introduced in 2000 as part of the Windows Resource Kit 2000/2003 tools. This utility was then included by default in Windows Vista and higher (including Windows 10). Openfiles displays the current open files list from local or shared folders, along with the Handle ID and Process executable name. This tool also allows you to disconnect one or more files that are opened remotely from shared folder.

Enable “Maintain Objects List” global flag for the First time

First, to enable tracking of local file handles, you need to turn on ‘maintain objects list’ flag by running the following command from admin Command Prompt.

openfiles /local on

You’ll see the following message:

INFO: The system global flag ‘maintain objects list’ is currently enabled.

You’ll need to run this command for the first time only. Then restart Windows for the change to take effect.

View open files and the corresponding process names

After restarting Windows, from an admin Command Prompt window, type:

openfiles

This lists the File/Handle ID, Process Name and the list of files opened locally or opened remotely via local share points, in a table format.

To view the output in List or CSV formats, use the /query parameter.

openfiles /query /FO LIST
openfiles /query /FO CSV

To copy the output to clipboard, pipe the output to Clip.exe as below. Then paste the output in Notepad or any other editor of your choice.

openfiles |clip

openfiles

openfiles /query /FO LIST |clip
openfiles /query /FO CSV |clip

openfiles

For more information on copying Command Prompt output to clipboard or save the output to a file, check out the article How to Copy Command Prompt Output Text to Clipboard or Save to File?

To find if a particular file is being in use by a program (and to know which program), you may use the following command-line.

openfiles | findstr /i <filename>

Example:

openfiles | findstr /i eiffel

The above command lists all open files that contain the word “eiffel” in the file name. In this example, Word 2016 is currently having the lock over the file “The Eiffel Tower.docx” (ID 4576).

openfiles-3-1

And “File In Use” dialog tells me the same thing.

openfiles

Disconnect files opened remotely from shared folder.

To disconnect files opened from shared folder so that you can delete, rename the file or modify the contents, use the /disconnect parameter to cut connections to that file. Here are the command-line options.


OPENFILES /Disconnect [/S system [/U username [/P [password]]]]
                      {[/ID id] [/A accessedby] [/O openmode]}
                      [/OP openfile]

Description:
    Enables an administrator to disconnect files and folders that
    have been opened remotely through a shared folder.

Parameter List:
    /S     system         Specifies the remote system to connect to.

    /U     [domain\]user  Specifies the user context under which the
                          command should execute.

    /P     [password]     Specifies the password for the given user
                          context.

    /ID    id             Specifies to disconnect open files by file ID.
                          The "*" wildcard may be used.

    /A     accessedby     Specifies to disconnect all open files by
                          "accessedby" value. The "*" wildcard
                          may be used.

    /O     openmode       Specifies to disconnect all open files by
                          "openmode" value. Valid values are Read,
                          Write or Read/Write. The "*" wildcard
                          may be used.

    /OP    openfile       Specifies to disconnect all open file
                          connections created by a specific "open
                          file" name. The "*" wildcard may be used.

    /?                    Displays this help message.

Examples:
    OPENFILES /Disconnect /?
    OPENFILES /Disconnect /ID 1
    OPENFILES /Disconnect /A  username
    OPENFILES /Disconnect /O Read/Write
    OPENFILES /Disconnect /OP "c:\My Documents\somedoc.doc" /ID 234
    OPENFILES /Disconnect /S system  /U username /ID 5
    OPENFILES /Disconnect /S system  /U username /P password /ID *

Resource Monitor

Resource Monitor (resmon.exe) is another built-in tool that has some neat features. With Resource Monitor, you can track network usage, view associated handles for locked files, as well as manage processes just as you’d using the Task Manager.

To find the process name that has a file locked, click the CPU tab, type the file name or part of it in the Associated Handles text box.

resource monitor find locked file

We’ve covered Resource Monitor earlier. Check out the articles How to Use Resource Monitor to Find Which Process Has Locked a File? and Which Program is Using all of Your Internet Bandwidth? Use Resource Monitor to Find it.

OpenedFilesView

OpenedFilesView from Nirsoft displays the list of all opened files on your system. For each opened file, additional information is displayed: handle value, read/write/delete access, file position, the process that opened the file, and more… Optionally, you can also close one or more opened files, or close the process that opened these files.

openfiles-6

You can close processes of selected files or close selected file handles. The handle number is represented in hex values whereas openfiles.exe console tool shows it in the normal format. This tool also lets you add a context menu option to quickly find the process which is currently using a file, via the right-click menu. The context menu option / command-line support, I consider, is one of the most useful features offered by OpenedFilesView.

Process Explorer

Process Explorer needs no introduction. In Process Explorer, all you need to do is use the Find feature and type in the file name. This shows the process that’s accessing the file.

openfiles-5

From the lower pane view, you can close the file handle if necessary.

Openfiles.exe perfectly does the job of listing all open files along with the process names, but it can’t forcibly kill processes. However, this excellent (but overlooked) built-in console tool can come in handy when you want to quickly find a process name that’s using a file, or to disconnect a file that’s being accessed through a shared folder by a network user — without depending on a third-party solution.

About the author

Ramesh Srinivasan founded Winhelponline.com back in 2005. He is passionate about Microsoft technologies and has a vast experience in the ITeS industry — delivering support for Microsoft's consumer products. He has been a Microsoft MVP [2003 to 2012] who contributes to various Windows support forums.

3 thoughts on “Find Which Process Has Locked a File Without 3rd Party Tools

  1. So, I couldn’t help noticing: You said without a third party tool and you ended up introducing two. ;)

    One important fact about Process Explorer is that it needs no administrative privileges. Without it, it can’t see all handles but for a standard user account, that’s probably okay, because that account can’t open elevated processes anyway.

    By the way, I have moved on from Process Explorer to Process Hacker.

Comments are closed.

+1
Share
Tweet
Share
Pin