openfiles.exe

Display a list of open files

With /query, openfiles displays the list of open files.

C:\> openfiles /query /fo table

Files Opened Locally:
---------------------

ID    Process Name         Open File (Path\executable)                       
===== ==================== ==================================================
64    fontdrvhost.exe      C:\Windows\System32
64    fontdrvhost.exe      C:\Windows\System32
64    dwm.exe              C:\Windows\System32
212   dwm.exe              C:\Windows\System32\en-US\dwm.exe.mui
388   dwm.exe              C:\Windows\System32\en-US\d2d1.dll.mui
1556  dwm.exe              C:\Windows\System32\en-US\crypt32.dll.mui
2168  dwm.exe              C:\Windows\System32\en-US\KernelBase.dll.mui
2212  dwm.exe              C:\Windows\System32
…

Note that the column ID does not identify a process id?

In order to get the process id also, the /v (verbose) flag must be given:

openfiles /query /fo table /v
Files Opened Locally:
---------------------

ID    Accessed By     PID      Process Name         Open File (Path\executable)                                                     
===== =============== ======== ==================== ================================================================================
64    UMFD-0          1000     fontdrvhost.exe      C:\Windows\System32
64    UMFD-1          1256     fontdrvhost.exe      C:\Windows\System32
64    DWM-1           1328     dwm.exe              C:\Windows\System32
212   DWM-1           1328     dwm.exe              C:\Windows\System32\en-US\dwm.exe.mui
388   DWM-1           1328     dwm.exe              C:\Windows\System32\en-US\d2d1.dll.mui
1556  DWM-1           1328     dwm.exe              C:\Windows\System32\en-US\crypt32.dll.mui
…

Options

`/disconnect`	disconnect one or more open files
`/query`	displays files opened locally or from shared folders
`/local`	enables/disables the display of local open files
`/v`	Verbose (also report Accessed By and PID)
`/command /?`	`/command` being one of `/disconnect`, `/query` or `/local`

Truncated IDs

This Serverfault question and corresponding answer indicates that the value of ID is truncated when using the (default) output /fo table, but is correctly returned with /fo csv or /fo list.

Enabling system global flag 'maintain objects list'

The system global flag maintain objects list must be enabled to use openfiles /local.

This is possible with. Note that it requires rebooting the computer to take effect.

C:\> openfiles /local on

This flag can also be set with gflags.exe.

The (bit-)value of maintain objects list is sorted in the registry key HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager, value GlobalFlags.

Example

Trying to move (rename) a directory in PowerShell:

PS C:\Users\rene> mv proj proj.old
move : Access to the path 'C:\Users\Rene\proj\' is denied.

Become administrator:

PS C:\Users\rene> start-process $( (get-process -pid $pid).path ) -verb runAs

Be prepared for the followign command to take some time until it is finished…

PS C:\Windows\System32> openfiles /query /fo table /v | select-string 'C:\\Users\\rene\\proj'
11376 Rene            60       explorer.exe         C:\Users\Rene\proj\some\sub\directory
13644 Rene            60       explorer.exe         C:\Users\Rene\proj\another\sub\directory

The third column of the output is the process id:

stop-process -id 60

Alternatively, the blocking process can also be found with the Resource Monitor (resmon.exe) (See this Stackoverflow answer). It looks like this is a faster alternative to find a blocking process.