Microsoft reveals why Windows 11 keeps saying a file is in use after closing app

https://www.windowslatest.com/2026/06/30/microsoft-reveals-why-windows-11-keeps-saying-a-file-is-in-use-after-you-close-the-app-plus-the-fix/

by thunderbong • 23 days ago

29 30 23 days ago

windowslatest.com

no-name-here• 22 days ago

It feels like the article is repeating information from some other source, but I don’t see such a source linked? (also note that this site is not associated with Microsoft.)

OptionOfT• 22 days ago

https://www.youtube.com/watch?v=DULHyCygDt4

This is the video this article is based on.

But you're right, source attribution is horrible in this article. And in every other article these days.

It is full of URLs that link to other articles on THAT website, sometimes categories, often these links are auto-generated.

Everything to keep you into their ecosystem, at the cost of quality of journalism.

snarfy• 22 days ago

But they can't be bothered to tell which process is holding it, not even a damn PID. C'mon guys, bare minimum here, and this issue has been there for decades.

It's great you added file locksmith to powertoys but that should be a built in OS feature for many, many years now.

dmaginas• 20 days ago

Maybe the Restart Manager API (RmStartSession/RmRegisterResources/RmGetList) can return the list of processes that hlod a file open. Is available since Vista. The Shell UI just doesn't call it.

Someone12342• 22 days ago

For most here, I don't think this article contains new information.

The actual interesting discussion, to me, is why Microsoft won't show WHO is dangling the handle open when the user tries to interact with a file via Windows' UI. To understand that, we have to look at a BSOD change Microsoft made in Windows 8:

In Windows 2K, XP, Vista, and 7 the BSOD would tell you exactly WHO was causing your BSOD (i.e. which module). Which was incredibly helpful, when you could see it was a e.g. Creative sound driver, or Nvidia graphics driver. Then in Windows 8/8.1 they went to the "sad face" simplified BSOD screen. From then on in order to see which module it originated in, you had to load the mini-dump into WinDbg (which almost no users would/could do).

What I am saying is: Microsoft went out of their way to shield their partners (OEMs/hardware vendors) from criticism with that BSOD UI change. So it seems unlikely they'd make a change to the "File Locked" UI that would essentially do the same thing: Open up their partners to criticism for their [bad] software (e.g. anti-virus/anti-malware/corporate compliance/etc).

Then tack on that Microsoft's own software may be some misbehaving software; and they'd essentially be telling on themselves. OneDrive in particular, I've seen in that list a lot (but I could write paragraphs on what a turd/abandonware OneDrive is).

FormFollowsFunc• 22 days ago

That’s a reasonable explanation. It would be so easy for them to show the offending application rather than the user closing all applications and it’s still locked and then having to restart Windows.

arcfour2• 22 days ago

But the offending module is not necessarily the module listed in the BSOD. It could be a victim too, one that got its memory corrupted by someone else.

That's one reason why they removed it, because it was causing end users to blame vendors/MS when they often had nothing to do with whatever the problem was.

Someone12342• 22 days ago

That edge case is certainly their official excuse.

Ultimately to determine the underlying root-cause you'd still need to dig this same information out, and all they've done is moved the starting line behind several walls. In essence adding extra work, without solving this edge case/issue.

Regardless of if the information is in the BSOD, Event Log, or only via WinDbg, understanding the information relies on the expertise of the person reviewing/contextualizing it. They've gone out of their way to make contextualizing it harder.

For example, to determine if it is a direct failure or an associative failure (e.g. RAM failing causing different BSODs in unrelated modules), you want that context to be obvious. But without the module being in the Event Logs, you're now loading up half a dozen MiniDumps in WinDbg to find that same very key information - which people may miss or fail to do.

What I am saying is: If we believe that excuse (which I don't), they've done absolutely nothing to address it and just made that same problem worse with their childish games.

mysterydip2• 22 days ago

while not root cause, wouldn’t a module having corrupted memory still be an issue with either the OS (for not protecting it) or the module (for not sanitizing input)?

meandmycode• 22 days ago

I believe it was removed actually because it's not a strong indicator of the real fault, there was an old article on this but could only find this more recent summary https://devblogs.microsoft.com/oldnewthing/20250121-00/?p=11...

RajT88• 22 days ago

"Microsoft Reveals" articles on this site are clickbaity. All this information lives in public docs, and is well known in the industry.

It is cool that Microsoft is writing these blog posts for laypeople, though. And yes, kind of crazy that some of these rough edges in the OS have not been smoothed out yet.

petilon2• 22 days ago

On Linux if a file can't be edited because some process is holding it open you can just mv the file to /tmp and create a new file in its place. The process that has it open is unaffected because the handle is independent of the path.

On Windows a file that is open in an application cannot be moved, plus it won't tell you which process has it open. Yes you can use some sysinternals tool but this is basic info that should be immediately available without installing some additional tools.

17186274406• 22 days ago

You can also just unlink it.

17186274406• 22 days ago

because the handle is independent of the path.

This makes me wonder, what happens [EDIT: on Windows] when a program uses a file, which more than a single hardlink points to, and you want to remove one of them. Does it matter, through which hardlink the file gets opened or are all the hardlinks prevented from being unlinked?

Chu4eeno• 22 days ago

On Linux you can delete all hardlinks to open files.

What you can't do is modify a file that's executing (program or library), then you get ETXTBSY.

yjftsjthsd-h2• 22 days ago

Hard links are just pointers to the file. You can remove any or all of them independently of each other and the running program. In fact, IIRC there's a semi-common pattern where a program will deliberately create a file, open it, and then unlink it, which leaves it usable but anonymous and in a state that will always be garbage-collected when the program exits.

jahnu• 22 days ago

I seem to remember that you could, however, rename the file for a similar effect on Windows.

petilon2• 22 days ago

No, you can't rename a file in use, unless it is explicitly opened with a sharing flag (which most applications don't).

somat• 22 days ago

In windows the shadow copy facility is used to sneak files around when they are open. I remember using a utility called "hobocopy" (a sort of pun on the more famous robocopy) that provided a command line user interface around shadow copy to let you move locked files.

In my specific case it was to save youtube videos when it was still a flash player. the video would be cached in a file but that file would be inaccessible because it was "open" hobocopy to the rescue. On linux it would make then delete the file depending on the open file descriptor to keep it around. The way to save it was to relink another name onto the inode. I can't quite remember but on linux I think you could use a /proc entry to get that inode and on obsd I would use fstat to find it and fsdb to make the relink.

As a unix aficionado I despise windows open file locking with a passion. Sure I understand it is probably more correct, An open file could be in any sort of corrupted state the only safe thing to do is default to single access and locking. But it is far more respectful to the user to just let them grab it whenever they want to. corruption be dammed.

jFriedensreich• 22 days ago

This issue was what had me give up on windows forever and its been around since forever. There are many situations when there is just no way to release files except restart. When the basics don't work nothing else even matters.

hjkl0• 22 days ago

“Reveals” is a very strange choice here. Was it previously a secret that they now decided to share? Was it previously unknown and only now discovered?

Really, it’s just an overly fluffy guide for using Sysinternals utilities to help fix the issue. With a heading that is criminally click-baity.

Eddy_Viscosity2• 22 days ago

On a possibly related issue, is this the same thing that cause the 'USB drive is still in use' message when you try to eject a USB drive even when every application is closed?

If so, does anyone know a fix for it?

17186274406• 21 days ago

On a drive there is also the filesystem, which might not be finished with its work. When a program writes to the disk it gets buffered by the OS/filesystem driver first, so that the program can finish, before the data is actually on the disk.

So there is no fix, because there is nothing to fix. If you remove the device before the OS tells you you can, you risk missing data or corruption.

Microsoft reveals why Windows 11 keeps saying a file is in use after closing app

Related Stories