Find out which process is locking a file or folder in Windows

Question

How can I find out which process is locking a file or folder in Windows?

For instance, when trying to delete a folder, Windows reports this:

The action can't be completed because the folder is open in another program

Happens the same with a file, but how do I find out what program or application is currently using it and preventing me from deleting the file or folder?

Answer 1

You can use the Resource Monitor for this which comes built-in with Windows 7, 8, 10 and 11!

1. Open Resource Monitor, which can be found
   • By searching for Resource Monitor or resmon.exe in the start menu, or
   • As a button on the Performance tab in your Task Manager
2. Go to the CPU tab
3. In the Processes section, select all processes by clicking the checkbox next to "Image" in the headers.
4. Use the search field in the Associated Handles section
   • See blue arrow in screen shot below

When you've found the handle, you can identify the process by looking at the Image and/or PID column.

You can then try to close the application as you normally would, or, if that's not possible, just right-click the handle and kill the process directly from there. Easy peasy!

Answer 2

A couple of options:

Microsoft/SysInternals Process Explorer - Go to Find > Find Handle or DLL. In the "Handle or DLL substring:" text box, type the path to the file (e.g. "C:\path\to\file.txt") and click "Search". All processes which have an open handle to that file should be listed.

WhoLockMe - Explorer extension which adds a right-click menu option

N.B. WhoLockMe appears to not work with Win 10 (at least I have been unable to register it with either of the 32- or 64-bit versions of regsvr32.exe).

Answer 3

Have a look at Process Explorer (procexp.exe).

From its introduction:

Ever wondered which program has a particular file or directory open? Now you can find out.

To find out what process is using a specific file follow these steps:

1. Go to Find, Find Handle or DLL.. or simply press Ctrl+F.

   

2. Enter the name of the file and press Search.

   

3. Process Explorer will list all processes that have a handle to the file open. Click on an entry to focus the process in the main window.

   

4. Optionally, you can then even close the handle manually through the lower pane (Ctrl+L):

   

Answer 4

PowerShell method:

if ((Test-Path -Path $FileOrFolderPath) -eq $false) {
  Write-Warning "File or directory does not exist."
} else {
  $LockingProcess = CMD /C "openfiles /query /fo table | find /I ""$FileOrFolderPath"""
  Write-Host $LockingProcess
}

The openfiles command needs to have support for local files enabled, by running openfiles /local on and restarting.

More details How to find out which process is locking a file or folder in Windows ^archive

Answer 5

LockHunter can unlock any handlers that may have locked your files or folders. Unlike similar freewares, it supports both 32 and 64-bit Windows.

It is a free tool to delete files blocked by something you do not know. LockHunter is useful for fighting against malware, and other programs that are blocking files without a reason. Unlike other similar tools it deletes files into the recycle bin so you may restore them if deleted by mistake.

• Shows processes locking a file or folder
• Allows to unlock, delete, copy or rename a locked file
• Allows to kill locking process
• Allows to remove locking processes from hard drive
• Integrates in to Explorer menu
• It deletes files into the recycle bin, so you may restore them if deleted by mistake
• Supports both 32 and 64bit Windows

Answer 6

Microsoft PowerToys File Locksmith utility does exactly what you are asking for.

• Right click on the file or folder to open a context menu
  
• The utility opens showing locking processes. There you can see which files are locked and terminate a particular process
  

Answer 7

EMCO UnlockIT can identify the process that has locked the file as well as unlock the file so that you may delete/edit/move it. The program is completely free, though the newer version is a bit slower and more bloated than the original (which had a plain, unskinned GUI, but loaded pretty much instantaneously and without an annoying splash screen). Also, the original version used to pop up automatically whenever the error you mentioned is triggered, allowing you to instantly unlock the file and perform the operation you were attempting.

Still, UnlockIT is an incredibly useful program that provides a basic functionality that is critically missing from Windows. It's among the standard toolkit of utilities that I install on all Windows computers I work on.

Answer 8

A lot of the programs here are outdated. I finally ended up using nirsoft's OpenedFilesView which worked really well.

Though the best part is the explorer menu integration, which is easy to enable. As per website

Explorer Context Menu

Starting from version 1.10, you can launch OpenedFilesView directly from Windows Explorer, and view only the handles of the file or folder that you want to inspect. In order to enable this feature, check the 'Enable Explorer Context Menu' under the Options menu. After you enable this feature, you can right-click on any file or folder on Windows Explorer, and choose the 'OpenedFilesView' item from the menu. If you run the OpenedFilesView option for a folder, it'll display all opened files inside that folder. If you run the OpenedFilesView option for a file, it'll display all opened handles for that file.

This tool still works reliably in 2019

Answer 9

If you do not know the program the file it is using then you can go to My Computer; right click; select Manage. Under System Tools > Shared folders > Open Files, you should be able to see the user who has locked the file. You can close file from here and then you can perform the task of rename or delete the file. Hope this helps

Answer 10

Additional possibility, just to save people the time I just spent:

In older versions of Windows, you might get "Access Denied - you might not have rights, or the file might be in use". If you find through Process Explorer that the files are, in fact, not opened by anyone, odds are that there is an issue with security. Using an administrator account, select the files in Explorer, right-click and select Properties, Security, Advanced, Owner. Odds are that the files are owned by an account that no longer exists or can no longer be verified to exist (because of changing Active Directory trust settings).

Change ownership to Administrators and you are good to go.

Answer 11

Here was my discovery & solution.

Incidentally, none of the above answers solved my problem.

I even tried using UNLOCKER which proved worthless.

My problem was that of Memeo Autosync Backup

Apparently, this backup process leaves enough of a "ghost like file." This "ghost like file," would show up whenever I would ALT-TAB my computer (Windows Professional XP), i.e. I would see TWO MS Excel Programs running, when I only had ONE visible, on my TASK BAR.

I came across this solution when I thought it might have been the SYMANTEC Endpoint (Anti-Virus) Protection; and disabled the program. However, I kept getting the error message:

cannot delete (LARGE.xls file): It is being used by another person or program. Close any programs that might be using this file and try again.

I subsequently kept seeing the Memeo notice of "syncing" and QUIT the program.

Subsequently, NO ERROR.

For you, it could be ANY of these background saves.

Answer 12

I am not sure if anyone used Process Viewer (PVIEW.exe). I was having trouble finding out the process that locked my epmd.exe which i was trying to delete, when I searched for Process Explorer app in my Windows 10 box - I found this app. So, I thought of giving it a try and it worked (so, this can be another option):

This app existed at the following location for me - C:\Program Files\Microsoft Visual Studio\Common\Tools\WinNT\Tools\PVIEW.EXE

Look for your locked application (file), and Kill Process to unlock the file.

Answer 13

You can also do it programmatically by leveraging on the NTDLL/KERNEL32 Windows API. E.g. have a look at the following code in Python which returns a list of PIDs that can then easily be killed using the Task Manager or similar tools.

import ctypes
from ctypes import wintypes

path = r"C:\temp\test.txt"

# -----------------------------------------------------------------------------
# generic strings and constants
# -----------------------------------------------------------------------------

ntdll = ctypes.WinDLL('ntdll')
kernel32 = ctypes.WinDLL('kernel32', use_last_error=True)

NTSTATUS = wintypes.LONG

INVALID_HANDLE_VALUE = wintypes.HANDLE(-1).value
FILE_READ_ATTRIBUTES = 0x80
FILE_SHARE_READ = 1
OPEN_EXISTING = 3
FILE_FLAG_BACKUP_SEMANTICS = 0x02000000

FILE_INFORMATION_CLASS = wintypes.ULONG
FileProcessIdsUsingFileInformation = 47

LPSECURITY_ATTRIBUTES = wintypes.LPVOID
ULONG_PTR = wintypes.WPARAM


# -----------------------------------------------------------------------------
# create handle on concerned file with dwDesiredAccess == FILE_READ_ATTRIBUTES
# -----------------------------------------------------------------------------

kernel32.CreateFileW.restype = wintypes.HANDLE
kernel32.CreateFileW.argtypes = (
    wintypes.LPCWSTR,      # In     lpFileName
    wintypes.DWORD,        # In     dwDesiredAccess
    wintypes.DWORD,        # In     dwShareMode
    LPSECURITY_ATTRIBUTES,  # In_opt lpSecurityAttributes
    wintypes.DWORD,        # In     dwCreationDisposition
    wintypes.DWORD,        # In     dwFlagsAndAttributes
    wintypes.HANDLE)       # In_opt hTemplateFile
hFile = kernel32.CreateFileW(
    path, FILE_READ_ATTRIBUTES, FILE_SHARE_READ, None, OPEN_EXISTING,
    FILE_FLAG_BACKUP_SEMANTICS, None)
if hFile == INVALID_HANDLE_VALUE:
    raise ctypes.WinError(ctypes.get_last_error())


# -----------------------------------------------------------------------------
# prepare data types for system call
# -----------------------------------------------------------------------------

class IO_STATUS_BLOCK(ctypes.Structure):
    class _STATUS(ctypes.Union):
        _fields_ = (('Status', NTSTATUS),
                    ('Pointer', wintypes.LPVOID))
    _anonymous_ = '_Status',
    _fields_ = (('_Status', _STATUS),
                ('Information', ULONG_PTR))


iosb = IO_STATUS_BLOCK()


class FILE_PROCESS_IDS_USING_FILE_INFORMATION(ctypes.Structure):
    _fields_ = (('NumberOfProcessIdsInList', wintypes.LARGE_INTEGER),
                ('ProcessIdList', wintypes.LARGE_INTEGER * 64))


info = FILE_PROCESS_IDS_USING_FILE_INFORMATION()

PIO_STATUS_BLOCK = ctypes.POINTER(IO_STATUS_BLOCK)
ntdll.NtQueryInformationFile.restype = NTSTATUS
ntdll.NtQueryInformationFile.argtypes = (
    wintypes.HANDLE,        # In  FileHandle
    PIO_STATUS_BLOCK,       # Out IoStatusBlock
    wintypes.LPVOID,        # Out FileInformation
    wintypes.ULONG,         # In  Length
    FILE_INFORMATION_CLASS)  # In  FileInformationClass

# -----------------------------------------------------------------------------
# system call to retrieve list of PIDs currently using the file
# -----------------------------------------------------------------------------
status = ntdll.NtQueryInformationFile(hFile, ctypes.byref(iosb),
                                      ctypes.byref(info),
                                      ctypes.sizeof(info),
                                      FileProcessIdsUsingFileInformation)
pidList = info.ProcessIdList[0:info.NumberOfProcessIdsInList]
print(pidList)

Answer 14

SysInternal's handle utility is designed exactly for this problem for the command line. Just execute the following:

handle -a path

Here is an example output:

→handle -a "C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db"

Nthandle v5.0 - Handle viewer
Copyright (C) 1997-2022 Mark Russinovich
Sysinternals - www.sysinternals.com

xplorer2_64.exe    pid: 108904 type: File           844: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
xplorer2_64.exe    pid: 108904 type: File          1098: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
xplorer2_64.exe    pid: 108904 type: File          1B78: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
explorer.exe       pid: 75252  type: File          2B68: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
explorer.exe       pid: 75252  type: File          4B1C: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
firefox.exe        pid: 20884  type: File          15A8: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db
firefox.exe        pid: 20884  type: File          3BF4: C:\Users\me\AppData\Local\Microsoft\Windows\Explorer\iconcache_32.db