Check our other helpful areas that might answer your question

Hello guys,

As the title says, today we are gonna find out how to detect what process keeps a file in use and what the file in use is.

The two methods are quite different, therefore we are gonna split the above task into two smaller ones, as it follows:

1. How to detect the process (application) that keeps a file in use?

During the install process (or uninstall), if the files from disk (to be updated/overwritten by the installation process) are kept in use by an application process, then the installation process either displays the 1610 error (The setup must update files or services that cannot be updated while the system is running) or the FilesInUse (or MsiRMFileInUse) dialog .

In order to detect the list of applications that keep files in use you can proceed like this:

• If you have an MSI setup or an EXE (without Enhanced User Interface) setup then

i. run the setup package with a command line like this
or
ii. open the log file in a text editor and search for error 1610, e.g. such portion of log

MSI (s) (60:88) [12:10:38:841]: RESTART MANAGER: Detected that application with id <PID>, friendly name '<app name>', of type RmCritical and status 1 holds file[s] in use.
MSI (s) (60:88) [12:10:38:841]: RESTART MANAGER: Did detect that a critical application holds file[s] in use, so a reboot will be necessary.
MSI (s) (60:88) [12:10:38:841]: Note: 1: 1610

Note: Please make sure you use the /L*VX log command, i.e. to include the X switch (extra debugging info).

• If you have an EXE setup with Enhanced User Interface set on install or to always (install, uninstall and maintenance) then

i. run the setup package with a command line like this
ii. open the log file in a text editor and search for the "FileInUseProcess" property; this property should include the names of the applications keeping your install files in use

2. How to detect what is the file that is kept in use?

A lot of users have asked this in the past and this was something I personally thought is impossible to find out. At least until recently, when investigating a scenario with the "FileInUse" dialog, I have noticed using Process Monitor that the msiexec.exe process actually queries the following registry entry:

HKEY_CURRENT_USER\Software\Microsoft\RestartManager\Session0000 —> the RegFiles0000 element

In the above key, you will find the application that is actually kept in use by the process displayed in the "FileInUse" dialog.

Let's consider the following example:

• we create a setup package that contains sample.exe executable

• we install that setup package

• we go to the installation folder and open the sample.exe (i.e. double click on it)

• we then go to "Control Panel" and launch the setup in Maintenance mode by pressing the "Change" button

• click "Next" --> select "Remove" --> click "Remove"

• when the "FileInUse" dialog appears, open the registry and travel to the key specified above, e.g.:

HKEY_CURRENT_USER\Software\Microsoft\RestarManager\Session0000 —> the RegFiles0000 element


This should display the path to the file that is kept in use.

Hope you will find this useful!

Best regards,
Catalin

Note: There is a typo in this post that nearly caused me to give up thinking it was outdated or incorrect This was very helpful and totally accurate, I found that 4 apps and a loaded library were the cause. Great work!

Notice the missing 't':
should be:

Hello,

Thank you very much for the heads-up. There was indeed a typo which I now corrected.

I am glad that you did not give up and found this article helpful in the end.

Best regards,
Catalin