3

(This question is not a duplicate of Find out which process is locking a file or folder in Windows I am asking specifically about when PID-4 is locking it (besides the fact that i'm saying without using guesswork. And that question doesn't even mention PID-4))

When System PID 4 is locking a file or folder, How can I determine what program/process/service is locking it without guesswork?

For example , see this result from process explorer showing a file that may be locked.

enter image description here

Now, without any guesswork, how can I determine what is locking it? (When the only info I see from process explorer is that it's SYSTEM/PID-4)

Added

Somebody asked if it is a duplicate of Process Explorer: How to find out what System PID 4 is The questoin is similar.. but there's no answer there that answered my case.. Also, the question there iis very simplistic and says "How could I find out which application "System, PID: 4" really is?"

I know that PID 4 isn't an application. It is something system related.. and may be a service.

So my question is not the same as that one. That one has misunderstandings about what PID 4 is and somebody could partly answer that question by just saying what it is and is not.

Improve this question
5
  • @Moab Not a duplicate of that question, see my edit to explain why incase it wasn't obvious
    – barlop
    Commented Jan 18, 2019 at 20:30
  • stackoverflow.com/questions/4378192/… System IS the process, it's the Kernel. And this StackOverflow question references Windows 7.
    – music2myear
    Commented Jan 18, 2019 at 23:06
  • @music2myear great link. (And if it works then an incredible find). Funnily enough I see that service "Application Experience", is described as "stopping" on my machinie, unfortunately I can't start it even when picking 'manual'.. But I think that service may be the issue, i'll look into what I can do re that service.
    – barlop
    Commented Jan 19, 2019 at 0:04
  • 1
    Does this answer your question? Process Explorer: How to find out what System PID 4 is
    – Gaia
    Commented Jan 16, 2020 at 19:56
  • @music2myear stackoverflow.com/questions/46685916/… was a bug in Malware Bytes Anti Virus (MBAM)!
    – barlop
    Commented Jan 17, 2020 at 4:01

2 Answers 2

Reset to default
0

It's the Windows Kernel. This virtual process contains all running kernel-mode drivers. This also includes Windows File Sharing, HTTP.SYS and probably all virus scanners.

Unfortunately, file handle accounting is only done at process level, so you won't be able to get additional information.

(source) (also flagging as duplicate)

Improve this answer
4
  • 2
    you just plagiarised somebody else's answer, you copy/pasted it from another question
    – barlop
    Commented Jan 17, 2020 at 3:55
  • it ain't plagiarism when the source is cited, go grab your dictionary. PLUS I flaged it as a duplicate question.
    – Gaia
    Commented Jan 17, 2020 at 5:24
  • 1
    You didn't include quotation marks so you made out like it was your own words and simply gave a link to a source that you used, except that you had actually copy/pasted it.. Also, you aren't meant to be copy/pasting answers from other users on the site. Furthermore, I didn't ask what PID 4 was, nor did I misstate what it was necessitating a correction, which is what was the case in that question you linked to
    – barlop
    Commented Jan 17, 2020 at 5:28
  • Oh excuse me sir, I missed the quotes. Nice work, detective!
    – Gaia
    Commented Jan 17, 2020 at 5:30
0

I could to an extent in that case and perhaps one could in some other cases..

For that one a lock on that file was causing an error from visual studio, and when I looked up that error I got a result about malware bytes causing a problem with it, i.e. there was a bug in malware bytes, that it'd lock the file. https://stackoverflow.com/questions/46685916/unable-to-copy-file-obj-debug-to-bin-debug-access-to-the-path-bin-debug-is-deni/53334130#53334130

There are perhaps certain suspect culprit programs.. anti-malware running, maybe 'application experience' being not manual.. Infact, the 'application experience' service was listed for me as 'stopping', and that may be because of a bug in malware bytes(MBAM).. That service needs to be manual.. at least for visual studio but maybe for other programs too. And it would be that by default anyway. If it's not then like in this case maybe a program is crashing it.

So as a general rule, if there's a piece of software that can't access the file, or can't do something with the file, or certain files, or its files, or files that it created, or files that it is working or dealing with, then that can be a useful thing to look for on google rather than just the file being locked 'cos for just the file being locked there don't seem to be many clues when it's PID 4.. Anti-malware may be a culprit though as it does scan files.

Improve this answer
1
  • @ItWasn'tMe I recommend cygwin cygwin.com/setup-x86_64.exe A lot of the other tools aren't well maintained and go out of date. I mention some of the tools here superuser.com/questions/168202/… and it seems to me that cygwin is most up to date, but if you find one that is better or as up to date as cygwin, then let me know.
    – barlop
    Commented Feb 28, 2020 at 8:07

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .