How to Unlock a File Locked by Any Process or SYSTEM?

Sometimes when you try to delete, rename or move a file in Windows, you may see a message that the file is busy/locked/used by another process. Usually the name of the program that keeps the file open is shown right in the File Explorer message window. To unlock the file, it is enough just to close the program. However, it may occur that a file or a library is used by an unknown or system process. Then it is harder to unlock it.

A file lock message may be different. For example, the following screenshot shows the file type and the app it is associated with:

File/Folder in Use. The action can’t be completed because the file is open in another program. Close the folder or file and try again.

Then you can easily understand which app has locked the file and close it.

However, sometimes you may see a more interesting message that a file is used by an unknown or Windows system process. It may be either a Windows process or other processes working with the System privileges, like an antivirus app, a backup agent, an MSSQL database, etc.:

The action can’t be completed because the file is open in SYSTEM.
Close the file and try again.

Let’s try to find out what program, service or Windows system process is using a file, how to unlock the file and whether it may be released without closing the parent process.

The easiest way to unlock the file is to end the process that has locked it. But it is not always possible, especially on the servers.

When a process in Windows opens a file, a file descriptor (handle) is assigned to the input/output stream. The process and its child processes access the file using the handler. Using Windows API, you can send a signal to your file system to free the file handle and unlock the file.

How to Unlock a File Using Process Explorer?

ProcessExplorer is a free tool from the Sysinternals kit you can download from Microsoft website (https://docs.microsoft.com/en-us/sysinternals/downloads/process-explorer). Let’s try to find a process that has locked a file and free the file by resetting the file handle of the process.

1. You don’t need to install ProcessExplorer: just download, extract and run procexp.exe as administrator;
2. Select Find -> Find Handle or DLL (or press Ctrl-F);
3. Specify the file name you want to unlock and click Search;
4. Select the file you want. The process having opened the file will be highlighted in the process tree. Right-click it and select Kill Process Tree to end the process. However, you can try and close the file handle without ending the process. The file handle you looked for is automatically highlighted in the Process Explorer bottom panel. Right-click the handle and select Close handle. Confirm closing the file;

So you have closed the file handle without ending the parent process. Then you can remove or rename the file.

How to Release a File Handle Using the Handle Tool?

Handle is another command line tool from the Sysinternals (you can download it on Microsoft website: https://docs.microsoft.com/en-us/sysinternals/downloads/handle). It allows you to find a process having locked your file and release the lock by freeing the handle.

1. Download and extract the Handle archive;
2. Open the command prompt as an administrator and run the following command: handle64.exe > listproc.txt
3. This command will save the list of open handles to a txt file. You can display handles for a directory the file you want to change is located in: Handle64.exe -a “C:\Program Files\App” or for the specific process: handle64.exe -p excel.exe
4. Open listproc.txt in any text editor and find the line that contains the name of the locked file. Copy the file handle ID (in the hex format). Then go up to the section where the process that owns the handle is shown and write down its ID. It is most likely that a process run as system will have PID 4.
   For some Windows system processes, handle.exe returns the following message: wininit.exe pid: 732 \<unable to open process>. It means that you cannot get any information about these system processes (even as administrator). To get file handles open by such processes, run the cmd.exe as System and try to get the list of handles again.
5. Then get back to the command prompt and reset the file handle by its HandleID and ProcessID. The command has the following format: handl64e.exe -c HandleID -p ProcessID For example: handl64e.exe -c 18C -p 18800
6. The tool will prompt you to confirm closing of the file for the process. Confirm it by pressing y -> enter.

If the system reacts to the closing of the file correctly, you will unlock your file without ending the process or restarting your server/computer.