Recently, I needed to close a file that was open via a network share on a server containing user home directories. This particular file was a temporary excel file opened from a user workstation. These files are easily identifiable, in this case the name was ~$Weekly Sales Report.xlsx. The Office suite of programs creates a temporary file that is prepended with the ‘~$’ characters, of the same file name which contains the logon name of the person who opened the file first. This temporary file is called the “owner file” and is used to prevent more than one network user from opening the same file in read/write mode at the same time. When this file exists and the second user goes to open the same file, they will see a similar message to the following:

This file is already opened by (user name). Would you like to make a copy of this file for your use?

The reason I needed to close this file, was because I was running robocopy to mirror a directory from one drive to another. Robocopy detected the file in use and would stall for 30 seconds then retry to copy the file. Since I didn’t specify how many times to retry, the default was one million times. How’s that for bringing a 450GB copy operation to a standing halt! Since this job was over 50 percent complete, I didn’t want to start it over – so the question was: How do I close this file in use?

The answer was a Sysinternals program called handle.exe. When running handle with no switches, it will print out every process and the files opened by it to the screen. This will typically be more information than the default cmd window buffer will handle, thus part of the information will scroll off the window. The easist way to deal with this issue is to pipe the output to a file and then search the text file. Here is an example:

C:\temp>handle > handle.txt

Now open handle.txt in notepad and search for (in my case): ~$Weekly Sales Report.xlsx.

The search yielded the following (edited for brevity):

------------------------------------------------------------------------------
System pid: 4 NT AUTHORITY\SYSTEM
395C: File  (R--)   E:\Personals\Joe.Didley\Reports\~$Weekly Sales Report.xlsx

So now I know that the process id ’4′ had the file open with an assigned id of ’395C’.

The command to close this particular file handle is:

C:\temp>handle -c 395C -p 4

Handle v3.45
Copyright (C) 1997-2011 Mark Russinovich
Sysinternals - www.sysinternals.com

395C: File  (R--)   E:\Personals\Joe.Didley\Reports\~$Weekly Sales Report.xlsx
Close handle 395C in System (PID 4)? (y/n) y

Handle closed.

Success! After the file handle was closed, robocopy automatically continued since the file was no longer in use.