up vote 134 down vote favorite
58
share [g+] share [fb]

One thing that annoys me no end about Windows is the old "sharing violation" error. Often you can't identify what's holding it open. Usually it's just an editor or explorer just pointing to a relevant directory but sometimes I've had to resort to rebooting my machine.

Any suggestions on how to find the culprit?

link|improve this question
6% accept rate
Awesome, I've had this problem on soo many occassions. – tsilb May 1 '09 at 3:15
2  
You would think that after all this time, the Windows guys would give us a way to do this easily from within Explorer. I wonder why this hasn't happened? – Andrew H May 5 '09 at 0:19
I find that Explorer is very often the problem process that is holding onto a file for no obvious reason. – Eddie May 8 '09 at 15:49
I know this doesn't help you much, but I think I remembered that this was a planned feature of the next Windows release after vista and 2008 server. or maybe it's a WinFS thing. not sure where i read that... – Kip May 30 '09 at 0:00
feedback

14 Answers

up vote 137 down vote

I've had success with Sysinternals Process Explorer. With this, you can search to find what process(es) have a file open, and you can use it to close the handle(s) if you want.

link|improve this answer
9  
You can close the handle, but keep in mind, you're pulling the rug out from under an application, results will be unpredictable at best. – WaldenL May 1 '09 at 21:57
7  
@Walden: Absolutely. YMMV. With WinXP, I've many times had Explorer open a handle for no obvious reason and refuse to close it. When this happens on a file you need to delete, you have the choice of forcing the handle closed, or rebooting. So far, having done this dozens of times, I have suffered no ill effect. As with any advanced tool, use with caution and judgment. – Eddie May 1 '09 at 22:32
Closing the handles can cause the app to re-use the handle on another file, causing corruption - see Jeff's answer below: serverfault.com/a/15695/79266 ... much safer to kill the application holding the file open, if you don't want to reboot. – RichVel Mar 30 at 8:32
1  
For explorer, btw, hold ctrl-shift and right-click a blank area of the start menu, and you'll get "Exit Explorer" - ps, not quite Jeff's answer.. – Mark Sowul Apr 2 at 18:56
feedback
up vote 57 down vote

unlocker is also useful for this (works on both 32 and 64 bit)

link|improve this answer
Have used unlocker for quiet sometime. It is very useful. – mjnagpal May 1 '09 at 0:58
We've recently installed unlocker to take out dumb processes when a Mac connects to CIFS and drops uncleanly. Ridiculous that you'd have to resort to that, but Windows is what it is. – jldugger May 1 '09 at 1:00
I use it everyday, love unlocker – paan May 14 '09 at 23:22
4  
If only it worked in 64-bit, it'd be perfect. Had to move over to Process Explorer when I upgraded my OS. – bdukes May 29 '09 at 16:48
Note that unlike Procexp, Unlocker will only detect open handles in the immediate context. If you run Unlocker on a parent directory and have a file open a few subdirectories down, Unlocker won't tell you about it. – Unsigned Oct 17 '11 at 17:59
show 1 more comment
feedback
up vote 38 down vote

Try the openfiles command.

link|improve this answer
2  
+1 for a builtin command, although I personally use ProcessExplorer for this most of the time. – RBerteig May 6 '09 at 2:04
Really helpful. – marko Sep 22 '11 at 8:40
feedback
up vote 16 down vote

I've used Handle with success to find such processes in the past.

link|improve this answer
1  
I use this tool all the time. If I can't eject a USB drive, I just type "handle H:" (or whatever the drive letter). Best of all, you can use it to force close handles. – Chris Thompson May 2 '09 at 7:02
feedback
up vote 12 down vote

Just be very careful with closing handles; it's even more dangerous than you'd think, because of handle recycling - if you close the file handle, and the program opens something else, that original file handle may be reused. And now guess what happens if the program continues to work with the handle, thinking it is some other file.

see Raymond Chen's post on this topic

link|improve this answer
+1 for the link. – Unsigned Oct 17 '11 at 18:03
important warning, this should go nearer the top - a reboot is probably better than a silently corrupted file. – RichVel Mar 30 at 8:27
feedback
up vote 4 down vote

Who Lock Me works well and keeps people amused with the name!

link|improve this answer
feedback
up vote 2 down vote

On a remote server, when you're checking on a network share, something as simple as the Computer Management console can display this information and close the file.

link|improve this answer
feedback
up vote 2 down vote

Apropos Explorer holding a file open: "When this happens on a file you need to delete, you have the choice of forcing the handle closed, or rebooting."

You can just end Explorer.

If this is a one-time thing (Explorer does not normally hold this file open) then I would guess logging off and logging back on will do the trick.

Otherwise, kill the desktop Explorer process and do what you want while it's gone. First start a copy of cmd.exe (you need a UI to do your intended cleanup). Make sure there are no non-desktop Explorers running. Then kill the last Explorer with, e.g., Task Manager. Do what you want in the command prompt. Finally, run Explorer from the command prompt, and it will become the desktop.

I'd guess there may be some residual unpleasantness if some systray programs can't deal with the shell restarting.

link|improve this answer
This is much safer than closing the handle, and less disruptive than rebooting. Applies to other programs too - I often find a Microsoft Office program holds locks on files even after I've closed them. – RichVel Mar 30 at 8:30
feedback
up vote 2 down vote

Just to clarify, this is more likely to be a result of misbehaving 3rd party apps not using the CreateFile API call correctly than it is to be anything in Windows itself. Perhaps it's a consequence of the design of CreateFile, but done is done and we can't go back.

Basically when opening a file in a Windows program you have the option to specify a flag that allows shared access. If you don't specify the flag, the program takes exclusive access of the file.

Now, if Explorer seems to be the culprit here, it may be the case that that's just on the surface, and that the true culprit is something that installs a shell extension that opens all files in a folder for it's own purposes but is either too gung-ho in doing so, or that doesn't clean up properly after itself. Symantec AV is something I've seen doing this before, and I wouldn't be surprised if other AV programs were also to blame. Source control plug-ins may also be at fault.

So not really an answer, but just some advice to not always blame Windows for what may be a badly written 3rd party program (something that can also happen on any other OS, by the way).

link|improve this answer
feedback
up vote 1 down vote

Files can be locked by local processes (unlocker is the tool to use) and by file access that comes in through shares.

There is a built-in function in Windows that shows you what files on the local computer are open/locked by remote computer (which has the file open through a file share):

* Select "Manage Computer" (Open "Computer Management")
* click "Shared Folders"
* choose "Open Files"

There you can even close the file forcefully.

link|improve this answer
feedback
up vote 1 down vote

Lockhunter (http://lockhunter.com/) works on 32 and 64bit systems.

link|improve this answer
feedback
up vote 0 down vote

There is NirSoft's Opened Files View as well.

link|improve this answer
feedback
up vote 0 down vote

I got turned on to the Exteneded Task Manager a while ago by Jeremy Zawodny's blog, and it's great for tracking down further info on processes too. +1 for Process Explorer as above, too, especially for killing processes that the standard Task Manager won't end.

link|improve this answer
feedback
up vote 0 down vote

There is a tool FILEMON and shows open files and handles. Its hard to keep up with its display if you watch it live, it does so quickly. But you can stop it from displaying live and you can watch all file open/write activity. Now owned by Microsoft but originally by Sysinternals

link|improve this answer
The updated version of this is process monitor. You can get it here:http://technet.microsoft.com/en-us/sysinternals/bb896645 – yitwail Jun 9 '11 at 19:49
feedback

protected by Zypher♦ May 17 '11 at 15:39

This question is protected to prevent "thanks!", "me too!", or spam answers by new users. To answer it, you must have earned at least 10 reputation on this site.

Not the answer you're looking for? Browse other questions tagged or ask your own question.