Catalin
Posts: 6509
Joined: Wed Jun 13, 2018 7:49 am

How to detect the process that keeps a file in use & how to detect which file is in use

Thu Oct 14, 2021 11:58 am

Hello guys,

As the title says, today we are gonna find out how to detect what process keeps a file in use and what the file in use is.

The two methods are quite different, therefore we are gonna split the above task into two smaller ones, as it follows:

1. How to detect the process (application) that keeps a file in use?

During the install process (or uninstall), if the files from disk (to be updated/overwritten by the installation process) are kept in use by an application process, then the installation process either displays the 1610 error (The setup must update files or services that cannot be updated while the system is running) or the FilesInUse (or MsiRMFileInUse) dialog .

In order to detect the list of applications that keep files in use you can proceed like this:
  • If you have an MSI setup or an EXE (without Enhanced User Interface) setup then
i. run the setup package with a command line like this

Code: Select all

msiexec /i <path_to_msi> /L*VX <path_to_log>
or

Code: Select all

setup.exe /L*VX setup.log
ii. open the log file in a text editor and search for error 1610, e.g. such portion of log
MSI (s) (60:88) [12:10:38:841]: RESTART MANAGER: Detected that application with id <PID>, friendly name '<app name>', of type RmCritical and status 1 holds file[s] in use.
MSI (s) (60:88) [12:10:38:841]: RESTART MANAGER: Did detect that a critical application holds file[s] in use, so a reboot will be necessary.
MSI (s) (60:88) [12:10:38:841]: Note: 1: 1610
Note: Please make sure you use the /L*VX log command, i.e. to include the X switch (extra debugging info).
  • If you have an EXE setup with Enhanced User Interface set on install or to always (install, uninstall and maintenance) then
i. run the setup package with a command line like this

Code: Select all

setup.exe /L*V setup.log
ii. open the log file in a text editor and search for the "FileInUseProcess" property; this property should include the names of the applications keeping your install files in use

2. How to detect what is the file that is kept in use?

A lot of users have asked this in the past and this was something I personally thought is impossible to find out. At least until recently, when investigating a scenario with the "FileInUse" dialog, I have noticed using Process Monitor that the msiexec.exe process actually queries the following registry entry:

HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 —> the RegFiles0000 element

In the above key, you will find the application that is actually kept in use by the process displayed in the "FileInUse" dialog.

Let's consider the following example:
  • we create a setup package that contains sample.exe executable
  • we install that setup package
  • we go to the installation folder and open the sample.exe (i.e. double click on it)
  • we then go to "Control Panel" and launch the setup in Maintenance mode by pressing the "Change" button
Change.png
Change.png (78.4KiB)Viewed 37773 times
  • click "Next" --> select "Remove" --> click "Remove"
  • when the "FileInUse" dialog appears, open the registry and travel to the key specified above, e.g.:
HKEY_CURRENT_USER\Software\Microsoft\RestarManager\Session0000 —> the RegFiles0000 element

FileKeptInUse.png
FileKeptInUse.png (53.56KiB)Viewed 37773 times

This should display the path to the file that is kept in use.

Hope you will find this useful! :)

Best regards,
Catalin
Catalin Gheorghe - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

arbitmcdonald
Posts: 2
Joined: Wed Apr 15, 2020 4:33 pm

Re: How to detect the process that keeps a file in use & how to detect which file is in use

Wed Feb 02, 2022 3:51 pm

Note: There is a typo in this post that nearly caused me to give up thinking it was outdated or incorrect :) This was very helpful and totally accurate, I found that 4 apps and a loaded library were the cause. Great work!

Notice the missing 't':

Code: Select all

HKEY_CURRENT_USER\Software\Microsoft\RestarManager\Session0000
should be:

Code: Select all

HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000

Catalin
Posts: 6509
Joined: Wed Jun 13, 2018 7:49 am

Re: How to detect the process that keeps a file in use & how to detect which file is in use

Wed Feb 02, 2022 4:00 pm

Hello,

Thank you very much for the heads-up. There was indeed a typo which I now corrected. :)

I am glad that you did not give up and found this article helpful in the end.

Best regards,
Catalin
Catalin Gheorghe - Advanced Installer Team
Follow us: Twitter - Facebook - YouTube

Return to “Sample Projects”