Helping people with computers... one answer at a time.

Windows tries to prevent corruption by disallowing removal of USB devices that are "in use". Unfortunately it's not always obvious what "in use" means.

Whenever I plug in a flash drive or my external hard drive (Western Digital My Book), I cannot safely remove when I click on the icon. I keep getting the message that the drive is currently in use -- try again later. But, no matter how many times I try, I keep getting the same message. I end up having to shut down my computer to remove the device.

Well, windows certainly thinks that some program is attempting to access the USB drive. Since it's not guaranteed to be safe to remove a drive while it's in use, Windows tells you that you can't. The "wait until later" part is all about waiting until that program, whatever it is, is done with the drive.

What program?

Figuring that out is the trick...

Here's the message we're talking about:

USB Drive Cannot Be Stopped Right Now

This pops up if you attempt to "safely remove hardware" on an external USB flash or hard drive and Windows thinks that the drive is in-use by some program on your machine.

It turns out that finding out what program that might be isn't particularly obvious, but we can go searching for clues.

"It's difficult to predict what you'll find that might have something open on your external drive."

Here's the approach I use.

First, go download and run Process Explorer - the free Sysinternals utility from Microsoft.

In Windows 7, either launch Process Explorer with the "/e" option (as in procexp /e - note the space before the /), or once it's running click on the File menu and then Show Details for All Processes. This will cause Process Explorer to re-launch itself with full administrative access. You may get a UAC confirmation. This is required to allow Process Explorer to see "inside of" all processes on the machine.

With Process Explorer running, use its Find menu, Find handle or DLL ... function, and search for \device\harddisk. You should get results similar to this:

Process Explorer: Search for \device\harddisk

You can see that the list includes several entries (yours will almost certainly be different). And it's not at all obvious which hard disk each line represents. However clues are here.

In my case I looked down this list and realized that WS_10001.WMA, listed in the right hand column, is an audio file that I was just listening to. I had failed to close the audio player (mplayerc.exe, listed in the left hand column). I closed the player, and "Safely Remove Hardware" worked just fine.

It's difficult to predict what you'll find that might have something open on your external drive. In my case it was simple, I'd been listening to an audio file that I immediately recognized. The clues you get might not be quite as obvious. In particular, check the list of programs you'll see on the right of your own search results list. See if any of those might have a reason to be accessing the USB drive.

I'm guessing that some of the unexpected offenders you might find in that list include anti-virus programs who've started scanning the drive, anti-spyware tools doing the same, the Windows indexing service (you might need to turn off indexing of the external drive) and other tools that might try to automatically access hard drives that are found on your system.

Article C3246 - December 23, 2007 « »

Leo Leo A. Notenboom has been playing with computers since he was required to take a programming class in 1976. An 18 year career as a programmer at Microsoft soon followed. After "retiring" in 2001, Leo started Ask Leo! in 2003 as a place for answers to common computer and technical questions. More about Leo.

Not what you needed?

Ken B
December 27, 2007 11:01 AM

Another useful feature of Process Explorer that you've pointed me to. Thanks. (I think I should take some time and just go through every menu choice and dialog box in that thing.)

In addition to "\device\harddisk", you may also want to search for "X:\" where "X:" is the drive letter of the USB drive.

Robert Petteway
December 28, 2007 6:16 PM

I noticed, at the bottom of a Microsoft document, the author put a comment about using "unhooker" to close any handles on the removeable drive. It is free, donate if you want, and it works great! Just r-click on the drive in explorer, unhooker shows, select it, and select close handles. Done.

Bill Holland
December 29, 2007 10:59 AM

I frequently have .doc files on a USB drive that I may have been editing. I use Word as my default editor for Outlook, also. I have found that I have to close Outlook in order for the "Safe to remove..." message returns. It took me awhile to find that one.

January 1, 2008 6:07 AM

Thanx Leo It was very good article.Now I am able to resolved the problem that I ever face.

susan b
January 17, 2008 8:32 AM

re: using "unhooker" to close any handles on the removeable drive: Just r-click on the drive in explorer, unhooker shows, select it, and select close handles. cant find this and cant unplug my WD external drive. thanks 4 the help! Susan

January 22, 2008 10:18 AM

Also there is another way of getting rid of this problem without any additional cliks - to use USB Safely Remove ( ). It fully replaces native safely remove utility and allows to displays programs are locking the device. It's not free, but it's very handy when you use USB gadgets often

Brian Bozwick
December 3, 2008 8:08 AM

closing outlook took care of the problem for me. I had sent an attachment from my usb drive and though e mail had been sent, I was still getting the "cannot be stopped error"

December 24, 2008 7:11 PM

If you are in Vista you can use the inbuilt Resource monitor to check what is accessing the disk. Resource Monitor actually lists the drive letter so it is a little easier to identify the correct disk if you have many drives.

However I am not sure if it is present in all the flavors of Vista.

January 9, 2009 11:42 PM

To unhook whatever is accessing your device, simply create a new folder anywhere, cut it and paste it in your recycle bin then emty your recycle bin.
now you should be able to safely unplug your device

January 15, 2009 12:41 AM

Why, after so many years and so many versions of Windows, does Windows still do this? What SHOULD happen when the user selects a device to Safely Remove is Windows should AUTOMATICALLY and QUIETLY close all open file handles and flush all pending writes to the drive, then pop up the OK box. If for some reason it thinks some file is still open, it should present a list to the user. If the user knows nothing on the drive is in use, there should be a button to smack Windows upside the head. If the drive happens to be open in Windows Explorer, Windows should simply and QUIETLY move to C: or somewhere else WITHOUT COMPLAINING, just like it does when you eject a CD while looking at it with Windows Explorer.

Why, after all this time, does Windows not behave in this logical manner? Will the current dumb behavior be perpetuated in Windows 7?

February 19, 2009 8:06 PM

The drive may also be optimized for quick removal as opposed to performance in the device manager. If you check it in the list of drives you can change the option with a restart required.

Urso BR
May 9, 2009 9:40 PM

I am having this problem right now. I wish there was a way to know which disk is which (\Device\HarddiskN etc.). However, the drive properties in Device Manager say that it's optimized for quick removal and "this setting disables write caching on the disk and in Windows, so you can disconnect this device without using the Safe Removal icon." I am just going to do that, by lack of an alternative. It is empty right now anyway, I just formatted it and wiped it with PGP Shredder to eliminate malware that often comes with new flash disks.

Question: doesn't the error occur simply because of the "quick removal" setting, meaning Windows has no cache to flush and can't "remove" something that is already not permanently attached?

January 5, 2010 6:32 PM

Ray wrote:
To unhook whatever is accessing your device, simply create a new folder anywhere, cut it and paste it in your recycle bin then emty your recycle bin. Now you should be able to safely unplug your device.
It is insane that MicroSHAFT has not fixed this crazy bug and everyone has to suffer for it. There are NO APPLICATIONS running and I cannot remove the USB drive because it says there are applications running. Crazy. This is why some people HATE computers, can you blame them???

Phil Goetz
January 17, 2010 9:01 AM

My Windows XP ALWAYS gives me this message, no matter what. There is no program using the USB drive. I can plug it in, copy one file onto the USB drive with Windows explorer, then shut down windows explorer, and it will still give me this message. I always have to shut my computer down to disconnect a USB drive.

Michael Carter
January 17, 2010 10:49 PM

I use an external Western Digital Elements drive to store old TV shows. Id turn it on, watch a show, and could never disconnect safely no matter what trick I tried. So I followed Leos advice, using process explorer, and noticed the process explorer.exe with a lot of handles on files on the drive, although no explorer browse window was viewing any of them. So using task manager I stopped the process explorer.exe, and also using task manager I restarted it. I was then able to remove the drive safely.

didn't work
February 20, 2010 5:11 PM

/device/harddisk returns 0 results. I guess this doesn'tw ork with windows 7? Thanks anyway.

March 7, 2010 5:12 AM

If you have AVG then that is the cause. It is a big bug that they plan to fix in the next version

April 25, 2010 6:54 AM

Response to "didn't work" who commented "/device/harddisk returns 0 results" - maybe it would work if you tried "\device\harddisk" as advertised?

May 7, 2010 12:23 AM

doesn't works on w7

Wished I'd thought of this a couple of months ago - sorry for the delay.

For whomever follows, in Windows 7 make sure that you click on File -> Show Details for All Processes. The security model in Windows 7 has of course changed somewhat. This option causes Process Explorer to re-launch itself with full administrative access. You'll probably get a UAC confirmation when you do it. Without this Process Explorer can't see inside of all processes.

Sian Doherty
October 15, 2010 1:45 PM

I also followed Leos advice, using process explorer and searched for \device\harddisk. 0 results. So I thought maybe explorer didn't close properly or something even though I had no windows open. I ended explorer.exe process in task manager (i had 2 processes of it running). then i restarted explorer.exe through task manager and voila i was able to safely remove the device. Does this have any detrimental effects on the system? or is it another legitimate alternative to the safely remove method when the process explorer method displays 0 results for \device\harddisk??

Bruce Bon
November 5, 2010 7:27 AM

I have the same problem, under Win 7, and after using Process Explorer in the All Processes mode, I see that PID 4 is the culprit, accessing several metadata and volume info files. This was also identified in the Event Viewer Warning associated with not being able to eject the USB drive. Task manager shows PID 4 to be "System", with description "NT Kernel & System". Pretty obvious that I can kill this process. What do I do, short of shut down??

Les Millgate
December 21, 2010 9:07 AM

I get it in WXP.
Download Unlocker (Google it, or Start Unlocker, find offending USB drive in the list, Click/double click, click 'Unlock all' (or all of the tabs!), message should have disappeared when you now try again.

Ravi Agrawal
December 21, 2010 9:44 AM

Most of the time it is the System Volume Information folder being accessed for creation / addition of Restore points which are not needed on USB drives.

I disable System Restore on all Drives except the Windows System drive, in most cases c:

With system restore disabled on all other drives & without any explorer windows focused on any of the drives' (sub)folders, I rarely encounter this sort of dialog.


Abdullah Eyles
December 28, 2010 11:10 PM

I was thinking to use Process Explorer as Leo recommends but I've got it installed as a portable version on the HD I want to remove! ;-)) Talk about shooting myself in the foot! (but then I suppose it would be useful to find what else is jamming up the system!)

May 25, 2011 3:59 PM

I had the same problem with the PID 4/System process. The solution Michael Carter proposed worked for me: I opened the Task Manager, closed explorer.exe in Task Manager and then re-opened explorer.exe in Task Manager. I was then able to remove the external hard drive without a problem. Let me add that this problem occurred repeatedly during the FIRST TIME I used my brand new Windows 7-running laptop. I will shortly contact Microsoft about this.

Merineth Cally
July 25, 2011 10:02 PM

Hey, it is more simple than all the above comments...just remove the maxtor icon and the autorun.inf and you're done...
Computer Courses Brisbane

May 12, 2012 8:24 PM

I get this error all the time and I thank the author for providing a useful way to find out what is causing the problem. I've found that frequently it's Microsoft's own software that does it; for example, if you've saved an MS Word file to a usb drive, Word will hold onto the drive even if the file is closed until and unless you close out of Word altogether. I find it rather ironic that Microsoft's operating system is incapable of controlling the behaviour of Microsoft's own applications. It might be different if it were a third-party app that was going a bit rogue, but when it's MS going rogue on itself, well....

Yes, I've experienced this as well - not just with Word, but with several programs from a variety of sources - closing the file sometimes doesn't release the file until you actually close the program. Very frustrating.
Les Millgate
May 19, 2012 8:07 AM

Download 'Unlocker': works perfectly for me.

Les Millgate

Les Millgate
May 19, 2012 8:14 AM

Download 'Unlocker': works perfectly for me.

Les Millgate

June 2, 2012 8:18 AM

Rick Broida of PCWorld recently had an article about this. He says (with the USB device plugged in) to right click "My Computer" on the desk top, select Properties then the Hardware tab. Click the Device Manager and expand the Drives device. Right click your USB device and again select Properties and under the polices tab make sure the "Optimize for Quick Removal" is selected. Then he says you can just remove your USB device without loss of data. Do you trust your data to it?

Bob D
August 30, 2012 4:21 PM

Well, here we are five years after the first comment! And the bug is still with us! Nothing like stability.

Windows 7 Home Premium
Procexp Version 15.22

Procexp File menu has no Show Details for All Processes
I run with admin.
USB drive, set for quick removal

When I run Macrium Reflect, and exit, Task Manager shows ReflectService.exe running, and Procexp's Find shows process System with Macrium files. When I click a line in Process Explorer Search window, the corresponding line in Procexp's main window's lower pane is highlighted. When I right click the highlighted line, and select Close Handle, I get the error "Error opening process: The handle is invalid."
Procexp doesn't show ReflectService.exe.
Killing ReflectService.exe with Task Manager made no difference; Procexp's Find still showed the Macrium files.

(I know why. The programmer who wrote the code sold his Microsoft stock and retired to the Riviera.)

Comments on this entry are closed.

If you have a question, start by using the search box up at the top of the page - there's a very good chance that your question has already been answered on Ask Leo!.

If you don't find your answer, head out to to ask your question.