Can’t delete a file: find what’s using it

The short answer: When File Explorer says the action cannot be completed because the file is open in another program—or the command line reports that the file is being used by another process, known as a sharing violation—a process has an open handle to the file. In Resource Monitor (resmon), you can search for the file name under Associated Handles on the CPU tab to identify the process holding it, then release the file safely by closing the application normally.

What this article covers—and what it does not

This article focuses on one specific situation: you have your own document—a text file, spreadsheet, PDF, image, or project file—that you want to delete or rename, but the system says it is open in another program. It does not cover freeing up disk space, deleting the Temp folder, or performing a large-scale system cleanup. Those are separate tasks requiring different procedures.

It is also important to define the limits of your responsibility. This procedure is intended for files you created or are authorised to manage and genuinely no longer need. System files, application databases, files on company servers, and files managed by antivirus software should not be treated as part of routine troubleshooting.

What “file in use” means and what a handle search proves

When an application opens a file, the operating system gives it a handle—a reference to the open file. Depending on how the file was opened and which sharing options were allowed, this handle may prevent the file from being deleted or renamed. Not every open handle blocks these operations; Microsoft documents the sharing modes, including permission to delete. When deletion is not permitted, Windows displays the familiar message that another program is using the file.

According to Microsoft’s documentation, you can search for a file name under Associated Handles on the CPU tab in Resource Monitor to identify the process keeping the file open. Alternatively, you can use Process Explorer from the Sysinternals suite, which can also search for open process handles. Resource Monitor is usually the quicker option when looking for a specific culprit because it is built into Windows and requires no download (Microsoft: Identify process blocking a file, Microsoft Sysinternals Process Explorer).

What the diagnostic check proves—and what it does not

It helps to understand the method’s limits so that you do not draw conclusions beyond what the results support:

What a handle search proves:

• a particular process currently has the file open,
• the identity of that process, including its PID,
• that the process may be, for example, a forgotten preview, editor, or sync client.

What the check does not prove:

• that the file does not require special permissions—an “Access denied” error may produce the same outcome for a different reason,
• that antivirus software or a backup service is not currently processing the file,
• that the issue is unrelated to cloud synchronisation—OneDrive and similar clients may briefly hold a file even after you close the application.

Finding no match therefore does not mean that the problem does not exist. It only means that the tool did not show a match for your search term with the permissions currently available.

Step-by-step instructions for Resource Monitor

1. Press Win + R, type resmon, and press Enter. Resource Monitor will open.
2. Switch to the CPU tab.
3. Expand Associated Handles; its header contains the Search Handles field.
4. Enter a unique part of the file name in the search field. Make it as specific as possible so that common words do not flood the results. If the file is named “quote-final-v3.docx,” search for something like quote-final.
5. Start the search and wait for the results. The list will show processes with matching open handles.
6. Note the process name and PID for each result. Verify the file name against its full path, as partial matches are common when using short search terms.
7. If the first search returns nothing, repeat it after a short while. Handles open and close dynamically.

Expected result: the list will show one or more processes. Typically, this will be the editor where the document remains open, the File Explorer preview pane, or a sync client.

What to do with the process you find—the safe approach

• Your own application, such as an editor or viewer: save your work, close the document normally, and exit the application. This allows it to release the handle cleanly.
• File Explorer preview: close the preview pane or another File Explorer window displaying the file.
• Sync client: wait for synchronisation to finish or exit the application through its notification-area icon. Do not interrupt it in the middle of a transfer.
• Antivirus, server service, or unfamiliar process: do not terminate anything. Give your administrator the process name, PID, and file path.

Once the file has been released, move an unwanted local document to the Recycle Bin rather than using Shift+Delete. Read the confirmation dialog before proceeding: network files, some files on removable storage, and large files may bypass the Recycle Bin. If Windows offers permanent deletion and you are unsure, cancel the action. Deleting a file from a synchronised folder may also delete its cloud copy, so check the service’s rules and confirm that you have an independent backup first.

Safe alternatives when the search finds nothing

If the handle search returns nothing, follow these steps in order:

1. Close all applications likely to have opened the file, and close the File Explorer preview pane.
2. Check whether the file is in a cloud-synchronised folder and wait until synchronisation becomes idle.
3. After saving your work, consider signing out and back in on your own computer. As a last resort on your own computer, you can consider restarting it, which closes all handles. Naturally, you should not restart a company server serving other users because of a single file.
4. If an “Access denied” error persists after the file is released, the cause may be permissions or file protection. Give the exact error to your administrator; do not change ownership or ACLs blindly.

What not to do: risky operations

Some tools and procedures can forcibly “kill” a handle or terminate a process. Microsoft’s Process Explorer documentation describes searching for open handles as a diagnostic function. Closing another process’s handles or forcibly terminating the process is a separate, risky operation that may corrupt data belonging to the application using the file (Microsoft Sysinternals Process Explorer).

As a general rule:

• do not terminate system processes or processes you do not understand,
• do not close handles belonging to databases or server services,
• do not change ACL permissions merely to delete your own file,
• do not edit the registry—there is no reason to do so for this task, and it will not help.

Decision table: what to do based on the result

Handover checklist for your administrator and verifying the result

If you escalate the issue, as businesses commonly do with company computers, provide the following information:

• the full path and name of the file,
• the name and PID of the blocking process shown in resmon,
• the exact wording of the error message and when it appeared,
• what you have already tried, such as closing applications, repeating the search, or signing out.

Verify the result: after closing the process you identified, repeat the search in resmon. This time, it should find nothing for the same search term. Then move the file to the Recycle Bin and do not empty it yet. If you accidentally delete something else, follow the guidance in accidentally deleted data: the first 10 minutes. Empty the Recycle Bin only when you are certain that you no longer need the file—and, if in doubt, after checking that it is not part of unfinished work or a backup.

Finally, remember the limits of this procedure: it is intended for ordinary Windows 11 workstations and your own data. If the file is on failing storage that reports read errors, do not continue repairing or rescanning the original. Work from a copy and leave the original for specialist recovery. If the file is in a directory shared by several people, the process holding it may be running on someone else’s computer and therefore be invisible from your workstation.

Frequently asked questions

Why won’t Windows delete a file that appears to be closed?

A process still has an open handle to the file—often a preview pane, a sync client, or a forgotten editor instance. If the application opened the file without allowing delete sharing, Windows may refuse to delete it. However, an open handle does not always block deletion.

How can I find exactly which process is holding the file?

Launch resmon using Win + R, open the CPU tab, and search for a unique part of the file name under Associated Handles. The result shows the process and its PID. Verify the name against the full path because short search terms can also produce unrelated matches.

Can I simply terminate the process holding the file?

You can close your own applications, but do it properly: save your work and exit the application. Do not terminate unfamiliar processes, antivirus software, server services, or system services; send the findings to your administrator. Forcibly closing handles is risky and may corrupt application data.

What if resmon finds nothing, but I still cannot delete the file?

Repeat the search after a short while, close all applications that might be using the file and disable the preview pane, or sign out and back in. If the message says “Access denied” rather than “Used by another program,” the likely cause is a permissions issue for an administrator to resolve; a handle search will not reveal it.

Is it safe to permanently delete the file as soon as it is unlocked?

No. Move it to the Recycle Bin and leave it there until you are sure you do not need it. If the dialog offers permanent deletion, cancel the action if you are unsure. Recycle Bin rules differ between storage types and services, and deleting a synced file may also remove its cloud copy.

When professional service makes sense

Describe a persistent fault in the service request, including the exact model, symptoms, when the problem began, and what you have already checked safely. For device repair and advice on the next steps, you can use the ITHOPE PC and laptop repair service. If unbacked-up data is also at risk, address the data first. The price and scope of the work can be determined once the cause has been identified.

Sources and review date

The technical sources were reviewed on 4 October 2026.

• Microsoft: Identify process blocking a file

• Microsoft Sysinternals Process Explorer

• Microsoft: CreateFile sharing modes