Find Out Which Process Has a File Locked

The error text names the operation, not the owner. **Remove-Item** and **Move-Item** fail differently, and the exact wording tells you whether a handle exists or the file is read-only.

Remove-Item 'D:\work\report.xlsx' -ErrorAction SilentlyContinue
(Get-Item 'D:\work\report.xlsx').Attributes
Get-Item 'D:\work\report.xlsx' | Select-Object Name,LastWriteTime,Length

**resmon** has a search box on the CPU tab that filters every handle by name. It is the fastest visual answer and needs no extra download.

resmon
:: CPU tab > Associated Handles > search box > report.xlsx
Get-Process | Where-Object { $_.Modules.FileName -like '*report*' } | Select-Object Name,Id

Restart Manager is the component behind the reboot prompt after an install. It can be called from PowerShell and returns the process id and name holding a file.

$sig = '[DllImport("rstrtmgr.dll", CharSet=CharSet.Unicode)] public static extern int RmStartSession(out uint h, int f, string k); [DllImport("rstrtmgr.dll")] public static extern int RmEndSession(uint h); [DllImport("rstrtmgr.dll", CharSet=CharSet.Unicode)] public static extern int RmRegisterResources(uint h, uint n, string[] f, uint a, object b, uint c, object d); [DllImport("rstrtmgr.dll")] public static extern int RmGetList(uint h, out uint n, ref uint na, [In,Out] RM_PROCESS_INFO[] i, ref uint r); public struct RM_PROCESS_INFO { public RM_UNIQUE_PROCESS p; public string s; public string a; public uint t; public uint u; } public struct RM_UNIQUE_PROCESS { public int d; public System.DateTime t; }'
Add-Type -MemberDefinition $sig -Namespace W32 -Name Rm -ErrorAction SilentlyContinue
$key = [guid]::NewGuid().ToString()
$h = 0; [void][W32.Rm]::RmStartSession([ref]$h, 0, $key)
[void][W32.Rm]::RmRegisterResources($h, 1, @('D:\work\report.xlsx'), 0, $null, 0, $null)
$n = 0; $na = 8; $ri = New-Object 'W32.Rm+RM_PROCESS_INFO[]' $na; $r = 0
$rc = [W32.Rm]::RmGetList($h, [ref]$n, [ref]$na, $ri, [ref]$r)
[void][W32.Rm]::RmEndSession($h)
"result $rc, holders $n"; $ri | Where-Object { $_.s } | Select-Object s,a,t

Sysinternals **handle** walks every handle on the system, which catches services and drivers that the other methods miss. Filtering on the file name keeps the output readable.

handle64.exe -accepteula -nobanner -a "report.xlsx"
handle64.exe -accepteula -nobanner -p explorer | Select-String 'report'
Get-Process explorer | Select-Object Id,StartTime

**Stop-Process** loses unsaved data, so prefer asking the app to close. When the handle holder is a service, restarting the service is gentler than killing the process.

$p = Get-Process -Name excel -ErrorAction SilentlyContinue
$p.CloseMainWindow() | Out-Null
Start-Sleep -Seconds 5
if (-not $p.HasExited) { $p | Stop-Process -Force }
Restart-Service -Name 'Print Spooler' -Force

A file that still refuses to move after the owner is gone is often read-only or marked as a system file. Attributes and an open handles check settle which of the two it is.

attrib -r -s -h "D:\work\report.xlsx"
(Get-Item 'D:\work\report.xlsx').IsReadOnly = $false
Remove-Item 'D:\work\report.xlsx' -Force
Test-Path 'D:\work\report.xlsx'