Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Being the good citizen I am, I left-click on the "Safely Remove Hardware" icon in my taskbar, and select my USB drive to dismount.

Then I get the message:

Windows can't stop your Generic volume device because it is in use. Close any programs or windows that might be using the device, and then try again later.

Of course, being the Operating System, it knows exactly what applications are using my device. So why won't it tell me?

Or is there a way that I can find out?

share|improve this question
I have had numerous occasions with Vista where I could never figure it out and it wouldn't "release" the USB until I had re-boot/shutdown. Upgraded to Win7 and have not had that problem since, so I figured, at least on my PC, it was a system driver issue. – BBlake Dec 24 '09 at 19:02
up vote 28 down vote accepted

You can use Sysinternals Process Explorer to find the handle for any files that are open. Just select the Find menu and select Find Handle or DLL. In the dialog that opens enter the drive letter into the search box. The search results should show all of the files that are open from the drive and which process has them open.

share|improve this answer
After Killing the offending process, Windows would still not free the USB drive. Go figure.... – Grantly Dec 24 '15 at 13:18
I only explored the drive with Explorer. Then from a cmd.exe shell, I ran a backup script on that drive, which finished. Closed the cmd.exe window. Killed and restarted Explorer.exe with Taskmgr. Still, the drive is in use and won't eject. – Kaz Jul 6 at 5:28
Process Explorer finds nothing for M:. – Kaz Jul 6 at 5:47

Simpler Method: Windows (10 at least) creates an entry in the event log when you try to eject a removable drive and you cannot because a process has a lock on it. One entry shows the process ID and the other the name of the process responsible for the lock.


1) Start the event viewer

2) Open up "Windows Logs" then "System"

3) Right click on "System" and choose "Filter Current Log"

4) In the dialog that comes up, enter "225" (without quotes) where it says "All Event IDs"

5) You will then see all events related to unable to eject because a process locked the drive.

6) Look at the timestamps on all these entries and find out which ones relate to the actual time when you tried to eject the drive.

7) Take appropriate action. Ending a task gracefully (closing the program that has the lock) is OK most of the time. Stopping the Windows Search service is also ok. Stopping an antivirus scan should be ok (if you don't suspect you have any viruses at the time). Going into the task manager and killing the process might not be ok. How to deal with this is beyond the scope of this question.

Event Viewer Entry

Event Viewer Entry

share|improve this answer
Good! Now I know it was Windows Defender... – manu Jul 19 at 14:32

For me (Windows 7).

  1. Hit Windows key
  2. In "search programs and files: type: diskmgmt.msc
  3. In search list find entry and right click - select run as administrator
  4. Enter admin credentials to run "Disk Management" (if required)
  5. Find offending usb drive that won't eject in disk list
  6. Left hand panel, right click select "Eject"
  7. Handles "should" close - you can always double check in sys internals process explorer

Note: "Safely remove hardware and eject media" taskbar icon no longer shows usb drive - just three dots

  1. Physically remove drive
share|improve this answer
No left hand panel or Eject command in Windows 7 Disk Management. (Version 1.00, according to Help/About). I can Shrink it, Delete it, Mark it Active, Format, ... no Eject. – Kaz Jul 6 at 5:32

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .