Windows Internals: After developing the Sysinternals suite and many other essential tools for Windows, Mark Russinovich now serves as Azure CTO at Microsoft. However, one of the longstanding software issues he encountered throughout his programming career continues to plague Windows to this day.
In a recent video published on the "Microsoft Developer" YouTube channel, Russinovich offered a concise explanation of what the "file is in use" error message means when Windows refuses to comply with a request. The creator of Sysmon, Process Explorer, and other popular Windows utilities discussed file handles and why Windows may have legitimate reasons to block a user's attempt to delete a file that is still in use.
Russinovich has been dealing with the notorious "file is in use" error since the 90s. He created Handle and Process Explorer to quickly diagnose and resolve this type of software issue. A handle is an abstract reference to a resource used by an application, such as a memory block, a file, or an object managed by another subsystem, including a database or the operating system itself.
When a handle is preventing a user from deleting a file, Russinovich explains, there are usually three possible explanations. First, the file may be locked by an anti-malware or antivirus program while it is being scanned. Second, the file may be in use over the local network, with another machine performing a storage-related operation.
The third explanation is the most troublesome. When a file is loaded into a process as a DLL, it may not appear as an open handle in Windows. In that scenario, determining which program is using the file can be extremely difficult.
For the first two cases, Russinovich said identifying the program holding the file should be straightforward with the help of Process Explorer. Furthermore, many third-party utilities are now available that perform the same task. After identifying the culprit, users should be able to close the application holding the handle and finally delete the stubborn file.
In the "DLL scenario," however, Process Explorer and similar tools may not provide the answer. Russinovich suggests renaming the blocked file and then replacing it with a fresh copy of the same file. In some situations, Windows allows users to rename a file even while it is still in use, which can resolve the issue.
As the co-author of several editions of Windows Internals, Russinovich's advice carries significant weight for developers and Windows power users alike.