How can I find out who is using a "file in use"?

When I'm faced with this situation, I grab my copy of SysInternals procexp.exe, a very nifty tool that does exactly what we need here (and a whole lot more). In a nutshell, Procexp is Task Manager on steroids. I've referenced it in several answers as a great tool to use to see what's running on your system. However it's also a great tool to see who's got that file open.

Let's assume that I'm trying to find out who has my mail folder open. In my case, that's the file "personal.pst". I'll run procexp and select Find, Find Handle.... (Every object such as an open file is identified by a unique number called a "handle" – procexp searches across all those objects, not just the files.) I'll enter in personal.pst and procexp will respond something much like this:

OUTLOOK.EXE        2956   C:\xfer\MAIL\personal.pst
OUTLOOK.EXE        2956   C:\xfer\MAIL\personal.pst
OUTLOOK.EXE        2956   C:\xfer\MAIL\personal.pst

Sure enough, as we might expect in this case, Outlook has the file open.

If you're networked, there's another situation that might need an additional step. For example, I keep my email archives on a server so we'll look on that server to see who has a past year's archives, 2004.pst, open. On the server, I'll use procexp as before to see who has 2004.pst open and the results will look much like this:

System             4      C:\admin\mail\2004.pst

OK, now that didn't help much. "System" is just that; the operating system. In this case, it's probably the networking component of the system that manages file access from remote users. So who's the remote user opening the file?

This one's easy, and the tools are already on your machine. On the server, right-click on My Computer, then select Manage, expand Shared Folders, and click on Open Files. There you'll see a list of files on the server that are currently opened by other computers on your network. That'll tell you the User who has the file open. You'll need to then click on Sessions to see what computers that user is connecting from. In my case, 2004.pst is in use by my laptop. So I'll head over to my laptop, once again run procexp, and this time search for 2004.pst there. The results:

OUTLOOK.EXE        2956   \Device\LanmanRedirector\leo\mail\2004.pst
OUTLOOK.EXE        2956   \Device\LanmanRedirector\leo\mail\2004.pst
OUTLOOK.EXE        2956   \Device\LanmanRedirector\leo\mail\2004.pst

Sure enough, Outlook running on my laptop has 2004.pst open (three times, again – that's just an Outlook artifact). In this case, you can see it's via something called the "LanmanRedirector" which is the part of Windows' networking software on my laptop that handles requests for files that are located across the network.

So, for simple "Who's using this file?" inquiries, procexp is a one-stop answer. If the network is involved, it might take an additional step or two.

But the answers are definitely out there.