How can I find out who is using a "file in use"?

Home » Windows » Windows Oddities

Summary: Windows will often report that a file is in use without telling you what program is using it. Process Explorer can tell you.

The scenario typically looks like this: you want to delete, move, perhaps rename a file, or maybe even just use it in another application and you get a message that you can't. The message indicates that another application is using the file.

Great. "What application?" you ask.

It wouldn't be that hard for Windows to tell you, but since it doesn't you'll need to do a little investigatory work yourself. Fortunately there's a free tool.

•

When I'm faced with this situation, I grab my copy of SysInternals procexp.exe a very nifty took that does exactly what we need here (and a whole lot more). Procexp is, in a nutshell, task manager on steroids. I've referenced it in several answers as a great tool to use to see what's running on your system. However it's also a great tool to see who's got that file open.

Let's assume I'm trying to find out who has my mail folder open. In my case that's the file "personal.pst". I'll run procexp, and select Find, Find Handle.... (Every object such as an open file is identified by a unique number called a "handle" - procexp searches across all those objects, not just the files.) I'll enter in personal.pst and procexp will respond something much like this:

OUTLOOK.EXE        2956   C:\xfer\MAIL\personal.pst
OUTLOOK.EXE        2956   C:\xfer\MAIL\personal.pst
OUTLOOK.EXE        2956   C:\xfer\MAIL\personal.pst

Sure enough, as we might expect in this case, Outlook has the file open.

If you're networked there's another situation that might need an additional step. For example, I keep my email archives on a server so we'll look on that server to see who has this years archives, 2004.pst, open. On the server I'll use procexp as before to see who has 2004.pst open and the results will look much like this:

System             4      C:\admin\mail\2004.pst

OK, now that didn't help much. "System" is just that; the operating system. In this case it's probably the networking component of the system that manages file access from remote users. So who's the remote user opening the file?

This one's easy, and the tools are already on your machine. On the server right-click on My Computer, then select Manage, expand Shared Folders, and click on Open Files. There you'll see a list of files on the server that are currently opened by other computers on your network. That'll tell you the User who has the file open. You'll need to then click on Sessions to see what computer(s) that user is connecting from. In my case, 2004.pst is in use by my laptop. So I'll head over to my laptop, once again run procexp, and this time search for 2004.pst there. The results:

OUTLOOK.EXE        2956   \Device\LanmanRedirector\leo\mail\2004.pst
OUTLOOK.EXE        2956   \Device\LanmanRedirector\leo\mail\2004.pst
OUTLOOK.EXE        2956   \Device\LanmanRedirector\leo\mail\2004.pst

Sure enough, Outlook running on my laptop has 2004.pst open (three times, again - that's just an Outlook artifact). In this case you can see it's via something called the "LanmanRedirector" which is the part of Windows' networking software on my laptop that handles requests for files that are located across the network.

So for simple, "who's using this file?" procexp is a one-stop answer. If the network is involved it might take an additional step or two.

But the answers are definitely out there.

Article 181 | Posted April 11, 2004