Skip to Content
Author's profile photo Karl-Heinz Hochmuth

File in use on Windows – how to find the responsible process?

This is a well known problem on Windows:

You want to delete a file, rename a file, you start a SAP upgrade, or database upgrade … and in any case you just get the “poor” error message:

File in use“.

or sometimes

Access is denied“.

But the most important question is: By WHOM is the file in use?
There are just 2 applications on Windows which will help you finding the originator. Both are available from

1. Handle.exe

The first one is handle.exe. You can start handle.exe and provide a path to the file or folder which is in use. Make sure to start the tool with administrative rights!


PS C:\SysinternalsSuite> .\handle.exe C:\usr\sap\BUZ\D01\work\sapstartsrv.log

Handle v4.0
Copyright (C) 1997-2014 Mark Russinovich
Sysinternals –

sapstartsrv.exe    pid: 4256   type: File           2D0: C:\usr\sap\BUZ\D01\work\sapstartsrv.log


The process which keeps an open file handle is sapstartsrv.exe, process ID 4256.

In some cases, handle.exe fails to find open handles. Therefore I use Process Explorer. Again, make sure to start the tool with administrative rights!

2. Process Explorer


The file “SAPevents.dll” is in use. SUM upgrade therefore stopped, because it’s not possible to delete this file.

PS C:\SysinternalsSuite> .\handle.exe C:\usr\sap\buz\d01\exe\sapevents.dll

Handle v4.0
Copyright (C) 1997-2014 Mark Russinovich
Sysinternals –

No matching handles found.


No success with handle.exe. Let’s start Process Explorer:

Process Explorer tells the truth. SAPevents.dll is in use by sapstartsrv.exe.


One more example with SAPevents.dll …

Scenario: SUM upgrade of a SAP system. SUM stops: SAPevents.dll should be deleted, but the file is in use.

Handle.exe doesn’t show anything.

But Process Explorer does:

Who is “svchost.exe”? It’s a so called “Service host” from the Windows OS, which hosts several Windows services.

Use Process Explorer tool, select PID 900 and you get information, which Windows services will be hosted by this particular svchost.exe:

It must be one of the listed services. In theory it can be any of above services. In this special example we’re looking for a service which keeps a handle to SAPevents.dll.


So, it should be the Windows EventLog?

Why is SAPevents.dll in use by the Windows EventLog service?

That’s because we have an open Windows Event Viewer and browsing the Application Log:

Everytime when you open Windows Event Viewer and load the Application log, the Windows EventLog service will load SAPevents.dll to display SAP specific errors, warnings, information and their description.

Therefore sapevent.dll is in use by svchost.exe which hosts the EventLog service.

The solution here is to close the Event Viewer or to restart the Windows EventLog service.

Assigned Tags

      Be the first to leave a comment
      You must be Logged on to comment or reply to a post.