![]() Index Time EntryType Source InstanceID Messageġ4692 Sep 07 10:50 Warning Microsoft-Windows-Ke 225 The application \Device\HarddiskVolume4\Windows\System32\Taskmgr.exe with process id 11972 stopped Here's a quick PowerShell command to query the event log and show which application is blocking drive ejection (works for me with Windows 10, probably works with 7/8 too) Get-EventLog -LogName System -after (Get-Date).AddHours(-1) | Where-Object | Sort-Object TimeGenerated | Format-Table -Wrap ![]() ![]() Once enabled, just right click on the drive in explorer and select What's using this file? MS PowerToys now has a handy utility that is likely to work in more circumstances File Locksmith But it helps you eject the drive and if it can't do it, it displays which processes have a lock on it: I am not sure why they charge for SafelyRemove when their free LockHunter already does the job. Better to use a dedicated tool for the job.ĭownload and run SafelyRemove, by the same people who make LockHunter. ![]() Although you can customize which PowerToy feature you want to enable, if this is the only one you will use, it's an overkill. It is called File Locksmith and it is a free download. UPDATE 2022: Microsoft's handy PowerToys now includes an extension to check which process is locking a file/folder. Via trial and error, close each program running, until there are no more handles on the locked file. After you close the program which has the locked file, launch handle and run (as an example) handle64 "Chrome SxS\Application\chrome.exe" to see if the handles are still present on the file that has the PID 4 lock. Since you cannot eject the boot disk (beacuse it is in use), the solution was to use another nifty Sysinternals utility, called Handle. UPDATE 2018: I've seen applications such as WhatsApp Desktop keeping handles on Chrome Canary via the System Process. If the file is on your boot drive, you can't put it offline. To get around this one you will have to go to disk management and put the drive you want to eject offline. If you don't have another entry with a process name, the System process (process id 4) is holding your drive.(Save the view.) in Actions panel (in the right frame) you could "Save Filter to Custom View." so you'll find it in "Custom Views" (in the left frame above the "Windows Logs") How to deal with this is beyond the scope of this question. Going into the task manager and killing the process might not be ok. Stopping an antivirus scan should be ok (if you don't suspect you have any viruses at the time). Stopping the Windows Search service is also ok. Ending a task gracefully (closing the program that has the lock) is OK most of the time. Look at the timestamps on all these entries and find out which ones relate to the actual time when you tried to eject the drive. You will then see all events related to unable to eject because a process locked the drive. In the dialog that comes up, enter "225" (without quotes) where it says "All Event IDs" Right click on "System" and choose "Filter Current Log" The two Event IDs 225 will show the process ID and the name of the process responsible for the lock. Native Method: Windows (10 at least, AFAIK) creates an entry in the event log when you try to eject a removable drive and you cannot because a process has a lock on it. Quick Solution: Install LockHunter, then right click on the file/folder/drive and choose "What's locking this.
0 Comments
Leave a Reply. |
AuthorWrite something about yourself. No need to be fancy, just an overview. ArchivesCategories |