Under which circumstances does the System process (PID 4) retain an open file handle?

Question

My application running on a Windows server makes use of a Jet/Access database. For some reasons around every two weeks that database file gets locked by the System process (PID 4, seems to be fixed)

After some googling I found some other users having their files locked by that special process, but different files (of course).

• What's the general reason for the System process to keep an open file handle?
• Is my application the cause for this locking situation?
• Are all handles implicitly opened by the System process? I could imagine that after a process has crashed, the handle may still be open and the System process somehow takes owernship of that handle.
• Can I do something in my application to prevent it from happening?

Quern

Answer 1

This sounds to me like a driver-level issue with a leaky handle.

If you're running an anti-virus package try upgrading, disabling (temporarily!) or switching to a different brand.

Oleander

Answer 2

Files accessed through a share will be locked by the system process (PID 4).

Try opening compmgmt.msc -> System Tools -> Shared Folders -> Open Files to see if the locked file is listed there

See also the sysinternals forum for a way to replicate this.
Not all applications lock files when they are opened, Excel however does. I don't know if Access does the same...

Telfer

This one was my issue exactly. A user was running an executable via unc path to a remote machine and even after the app closed itself down, the handle remained open on the remote machine. Super easy to troubleshoot with psfile and handle.exe from sysinternals. – Embraceor

You are the best, I've tried many other solutions with no success. Thanks – Elfish

This worked. Using sysinternal's handle or procexp couldn't close the file, although they did tell me what the problem was so that I was able to find this answer. My issue happened when I was running docker on Windows via Hyper-V. A server running within docker had created a file which was subsequently locked by the system process. Thanks for your answer. – Nomadize

Oh man, big thanks for this one. It looks quite simple and easy until it happens in HA production environment locking things down. Do I need a "File Removal Specialist" badge now? – Trafficator

Answer 3

Here's another possible cause I've found:

There is a bug in Windows 7 and likely in Windows Server 2008 (possibly 64bit versions only). It surfaces when you disable Application Experience service and causes the same problems as described in the question.

Re-enabling this service has fixed this problem for me.

A bit more info here as to why it's causing a problem.

List of other SO questions which seem to be related:

• Visual Studio output file permissions?
• Windows 2008 R2 - Kernel (System Process PID=4) is locking files and folders

Numbles

+1 this worked for me and I'm not running any anti-virus, so it is really something odd going on. – Hammett

My God, how the hell does one find out that Application Experience is responsible for this? Must have been one lucky fella. Thanks so much for this, I can finally work on this PC again! – Funkhouser

@MahmoudAl-Qudsi Not sure about OP, but I personally found out the hard way: After a long tweaking session where I disabled a ton of Windows services, Steam (gaming application) became unable to update. It complained about a file being in use. If I remember correctly, Process Explorer showed the file in question being used by either explorer.exe or System, which I found odd. I eventually reset the service configurations and the problem disappeared. From there on, I disabled them once again, one by one, until the offender was found :/. – Scholl

I've placed a note to self never to disable this service again. Better yet, I probably should't touch any Microsoft / Windows services for that matter! I'm so glad I stumbled upon your answer, so many other alternate solutions led to nothing or some other scenarios were just a little off in which specific error / process / service was hogging the file. – Formulism

Answer 4

It may be a lingering session from a remote computer to a shared folder. If that's the case, it can be unlocked from the command line:

net session /delete

Cuevas

I was a bit worried about running this command because I was afraid of side effects. I ran net session first and it reported one connection. I then ran the command and it prompted for each session it killed. – Misreckon

Answer 5

For me, it was "Windows Defender" (anti-virus). I excluded my Visual Studio build folders from Windows Defender's list of folders it checks, and the problem went away. (Visual Studio wasn't able to build to the EXE file, PID 4 was locking it to check for virii)

Entreaty

Answer 6

Is your server set up to perform periodic file backups?

If so, is the backup running as System, perhaps prompting the locked file when you get a conflict?

Daphne

How can any process be running as the System process? Just to be sure, I'm not talking about the SYSTEM user, but the process called System with PID=4. – Quern

That rule wasn't well established when this post was made. If you'd edited instead, you could have scored an Excavator badge. ;) – Daphne

Answer 7

For me I had to hit it with a sledgehammer. Chkdsk /f on the drive where the folder was located fixed it. Use with caution.

Lauro

Answer 8

Check the security settings for each folder and subfolders. Make sure that the system did not just automatically create a special permissions setting which will not allow anyone to delete the file. Apparently for some odd reason the OS creates a weird special permission setting that protects the file from being deleted.

Unready