Solved

find what has a file open

Posted on 2011-09-09
18
445 Views
Last Modified: 2012-05-12
i have a file that is on a shared network drive that is open by a process that is not running on the computer i am on.   i cannot delete it because of this.
is there a way i can find out what has it open?
0
Comment
Question by:CASorter
  • 6
  • 5
  • 3
  • +3
18 Comments
 
LVL 6

Expert Comment

by:-tjs
ID: 36512163
Couple of things to try:
If a user has it open on the share remotely:
-Computer Manager (right-click My Computer->Manage)->System Tools->Shared Folders->Open Files.  From there you can terminate a user's connection to a file but you might want to ask the user to close it first.

-Download Process Explorer from http://technet.microsoft.com/sysinternals, run ProcExp, and use Find Menu->Find Handle or DLL->type in the name of the file.
0
 

Author Comment

by:CASorter
ID: 36512228
did both of those already.
the only thing that shows under open files is \pipe\spoolss   about 40 times.

the file is not on this computer..  it is on a remote mapped drive

procexp only shows local processes running on this machine.

the file is a remote file, being held open by a remote process.
 i have access to the file.
it is an import file that i import and then rename when i am done.
i can read and import the file fine.
i cannot rename it.  when i try it says that the file is open.
i do not think that any proccess running on the physical machine i am on has it open.

what i think has happened is that the process used to create the file has gotten stuck and has left it open.  

i need to find out what/where that is so i can let the operator know to go to that machine and do what is needed to unlock the file.

0
 
LVL 18

Expert Comment

by:awawada
ID: 36512319
You will be able to delete this file with Unlocker 1.9.1 .
http://www.emptyloop.com/unlocker/#download
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 36512367
awawada,
Don't think you can use Unlocker remotely?!

CASorter,
You can still what tjs suggested in http:#a36512163. Open the Computer Manager, right click on the root entry, and connect to the remote PC. If you have valid credentials you should be able to view the remote shares, sessions and files open. You can then close that handle.

Often a Antivirus software holds files for longer as necessary - that could be another culprit, besides the creating process.
0
 
LVL 18

Expert Comment

by:awawada
ID: 36512549
@Qlemo
If he is having a shared network, he can map the share and delete the file from his computer!
I have done this tousend times...

0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 36512645
like has been said you can use comp mgmnt from the computer you are on.... Or just use it direct on the server console or rdp session where the file share resides.
0
 

Author Comment

by:CASorter
ID: 36513054
i RDPed directly to the computer.
opened up computere managaement there, the file in question did not show

the file is a text file.
i opened another file in notepad.

that also did not show in the open file list...
does computer management show open text files?

the only files i see as "open" are .dll and .exe files

i was able to go to the file in question, and was not able to remove it, (or rename it) even though i browsed to it on the physical drive.

0
 
LVL 4

Expert Comment

by:ZeevM333
ID: 36514045
0
 
LVL 43

Expert Comment

by:Steve Knight
ID: 36514253
That will only show what is open through shares.  I suspect then that the file may be open from the server itself then?  You can see what shares have connections too if you check the other pages of comp. management.

Have a look with openfiles.exe - that is available on XP and 2003 to my knowledge though the first time you use it you have to turn on local file object checking or something - needs a reboot afaik which of course would clear your open file anyway.

http://www.microsoft.com/resources/documentation/windows/xp/all/proddocs/en-us/openfiles.mspx?mfr=true

Steve
0
Ransomware-A Revenue Bonanza for Service Providers

Ransomware – malware that gets on your customers’ computers, encrypts their data, and extorts a hefty ransom for the decryption keys – is a surging new threat.  The purpose of this eBook is to educate the reader about ransomware attacks.

 
LVL 18

Expert Comment

by:awawada
ID: 36515307
@CASorter

Did you try Unlocker?
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 36515457
On the server you can use ProcExp as recommended earlier to find which process, running on the server, has that file open. You cannot do that remotely, however, ProcExp has to run on the system the processes with open files are.
0
 

Accepted Solution

by:
CASorter earned 0 total points
ID: 36911258
the file was eventually cleared by the station that had it open.  
none of the solutions got to the core question.    how to tell what has a file open if you are not at the computer that has the file open, but are looking at the file on a network share, and cannot manipulate it (delete,rename,save changes)  because something else, not at your computer, has it open.

0
 

Author Closing Comment

by:CASorter
ID: 36938165
question not answered.
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 36911448
Would have followed my advice with ProcExp, you would have seen which process held the file open.
0
 

Author Comment

by:CASorter
ID: 36911561
tried this.
procexp shows, as far as i can tell, running programs.. ie  processes.

it is not a process...  it is a text file.. "as mentioned earlier"

i read in the text file.
when i am done i rename the text file.

i cannot rename it because something else has it open.

i tried opening a local file with notepad, ran procexp,  searched for notepad. all that showed up was that notepad was running, it did not indicate, as far as i could see what file it had open.  i searched for the file name itself, nothing showed in procexp.

i tried opening the same file from a remote machine, when i tried to rename that file on the local machine i got an access denied message.
i ran procexp again on the local machine, put in notepad to search,  nothing showed up, put in the name of the file i had open on the other machine, nothing showed.



0
 
LVL 68

Expert Comment

by:Qlemo
ID: 36911629
Notepad is special - it does not hold the file while open. If you had used e.g. Word, you should have seen it in ProcExp.
However, the second case (remote) is interesting - if there is no handle open, you should be able to rename or delete the file. If there is a handle open, it is found by ProcExp when searching for the file name.
0
 

Author Comment

by:CASorter
ID: 36912000
try it.

from computer A  browse to computer B and open a text file with notepad or wordpad.

then go to computer b itself and try and rename or change and save it.  i dont think you will be able to.  

it will say access denied.

in playing with this i did successfully rename the open file on occasion, i think the locking occurs once a change to the file was made.

regardless of being able to reproduce the access denied,,  i dont think you will be able to tell who has the file open,

attached is a screen shot of me having a local file (c:\install.ini) open,
the info in the procexp screen does not contain anything referencing install.ini.



if i close the wordpad document  and redo the wordpad handle search, i get zero files.


procexpEXAMPLE.bmp
0
 
LVL 68

Expert Comment

by:Qlemo
ID: 36938391
As said, neither Notepad nor Wordpad hold the file locked when open. Only if at that moment when you save, a file lock is aquired for a very short period. After that, the file is no longer shared, open, or whatever. I tried several times now on a XP system, and had no issues renaming or deleting the file locally or from remote while (remotely) opened in Notepad. Whether the file has been modified or not did not change the behaviour.
I assume there is another process holding the file, likely something like a Antivirus application. But we will never find out now.
0

Featured Post

NAS Cloud Backup Strategies

This article explains backup scenarios when using network storage. We review the so-called “3-2-1 strategy” and summarize the methods you can use to send NAS data to the cloud

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Citrix XenApp, Internet Explorer 11 set to Enterprise Mode and using central hosted sites.xml file.
NTFS file system has been developed by Microsoft that is widely used by Windows NT operating system and its advanced versions. It is the mostly used over FAT file system as it provides superior features like reliability, security, storage, efficienc…
In this video, we discuss why the need for additional vertical screen space has become more important in recent years, namely, due to the transition in the marketplace of 4x3 computer screens to 16x9 and 16x10 screens (so-called widescreen format). …
Windows 8 came with a dramatically different user interface known as Metro. Notably missing from that interface was a Start button and Start Menu. Microsoft responded to negative user feedback of the Metro interface, bringing back the Start button a…

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

16 Experts available now in Live!

Get 1:1 Help Now