Sometimes when you try to determine what process has an open handle to an object (file, registry key, etc.), you will find that it is the
The object handle is showing as belonging to
System, but it is actually a driver, service, or even occasionally a shell-extension that is using it.
Does anyone know of an (easy) way to determine precisely what is opening the object?
One option is to examine the threads in the
System process, but that is a lot of manual work, and does not always return the expected information (it would require for each driver/service/extension, individually disabling and even rebooting to check the handle status).