29

My daughter had her thumb drive plugged into my desktop, doing some work. She finished, logged off of her account and I logged into mine. I noticed that she left her thumb drive in the USB port, and so I tried to safely eject it, but I get the following message:

Problem Ejecting USB Mass Storage Device

This device is currently in use. Close any programs or windows that might be using the device, and then try again.

OK, I give up. I just logged into my account and the first thing I did was try to eject her thumb drive. What in heck is currently using it? I don't have anything else opened/running when I got that message. How do I determine what program is apparently running and doing whatever it is, against that USB drive? How do I get whatever it is, to stop so I can safely disconnect the thing?

7 Answers 7

13

You can use Unlocker to find out what program has it opened, then close that program. If you cannot exit the program, you can use Unlocker to force the handle closed.

Unlocker showing processes with open handles


If it is Windows Explorer, you can restart it. En easy way is to hold Control + Shift and right-click a blank area in the Start menu:

Restarting Explorer in Windows 7

9
  • So how do you get the "exit explorer" context menu?
    – Moab
    Feb 8, 2012 at 3:05
  • Oops, sorry. Fixed. (I don’t use that method; the few times I actually had to restart Explorer in Win7, I used an option called “Restart Explorer”. I can’t figure out where it is right now—I’m in XP at the moment—but next time I’m in 7, I’ll see if I can find it and add it as well. And no, it was not a third-party one that used taskkill, it was built-in, to my surprise—ie, Microsoft basically acknowledging the need to restart Explorer.)
    – Synetech
    Feb 8, 2012 at 3:11
  • 1
    After exit of explorer using context menu, how do you get explorer to reload? ctrl+alt+del twice allows you to open task manager to do it, so it seems better to use task manager to exit explorer in the first place.
    – Moab
    Feb 8, 2012 at 17:49
  • 1
    @DavidBalažic, have you tried the installed version? You could also try Handles or Process Explorer. If no open handles are being reported, then it could be open by a driver instead of by a program. In that case, you need to make sure to run the program (e.g., Process Explorer) as admin to see it.
    – Synetech
    Jan 2, 2014 at 0:05
  • 1
    I edited this answer to point to the portable version hosted on Softpedia. "Several optional and usually unwanted software programs may be offered during the installation process. This can only be avoided by being careful not to click on the 'next' or 'install' buttons when the text reads e.g.: by clicking 'next' you agree to .... Instead the left button which is usually labelled cancel has to be chosen in order to continue with the regular installation." See deletedwikipedia.gawker-labs.com/wiki/Unlocker
    – Marc.2377
    Jul 3, 2016 at 3:10
11

The key is to identify the process that has a directory open on the device you need to unmount (I've used the following on Windows 7).

  • A search for warning Event ID 225 from Kernel-PnP in Windows Logs / System log file should find a message of the form "(something) stopped the removal or ejection for the device (something)".

This is already explained in the post:

Access "Computer Management" (right-click "Computer" / "Manage")

System tools -> Event viewer -> Windows Logs -> System

Use 'Find' to search for the event ID.

  • You can also install Process Explorer to perform a search for the process or application:

Use that utility to search for a handle with the target drive letter (for example f: ), available under Find / Find handle or DLL ... That will help identify the offending process / PID, (similar to use of 'lsof' command under Linux), and the process can be stopped manually (e.g. using Task Manager or Process Explorer). You may need to run Process Explorer as Administrator if you are not the owner of the process.

I've found that some apps keep the directory open, even after a file has been saved and closed. Sometimes it is enough to open another file from your C: drive to reset the "current" directory for the app. Also, apps may still be running after the window has been closed. The searches above will help identify which app you need to stop.

1
  • 1
    The system log is the only method that pointed out my anti-virus (NOD32) as the culprit, since Process Explorer and other programs can't "spy" on it.
    – Chema
    Apr 9, 2019 at 4:27
3

Another option that does not require third party tools:

  1. Open "Disk Management" (aka "Create and format hard disk partitions")
  2. Locate the disk you want to eject from the lower-left stack of Disks.
  3. Right-click the disk and choose "Offline".
  4. You can then attempt again as normal to "Eject Device" from the system tray, which should now succeed.

enter image description here

One disadvantage to this approach is when you plug in again, you may have to go through the process to put the disk into Online mode.

1
  • This is the only way I could eject the drive because Windows Defender was scanning it (observed in Event Viewer). It is a bit of a hassle to remember to put it online next you plug it in. Next time I'll try taking it offline, putting it online, and ejecting before Defender grabs it again.
    – User5910
    Oct 1, 2021 at 17:40
2

You need to identify the process(es) which are using the drive. Run the following command in PowerShell:

Get-WinEvent -LogName 'System' | Where { $_.Id -Eq 225 }

It should show an entry with the message like below:

The application <executable_path> with process id <process_id> stopped the removal or ejection for the device <usb_device_id>.

Try exiting the app or stopping the process otherwise.

0

Microsoft has its own utility called Devcon.exe.

From the site:

DevCon (Devcon.exe), the Device Console, is a command-line tool that displays detailed information about devices on computers running Windows. You can use DevCon to enable, disable, install, configure, and remove devices.

DevCon runs on Microsoft Windows 2000 and later versions of Windows.

0

When you can trace processes which occupy drive there is no much problem (for example with mentioned earlier Unlocker small tool). However, sometimes this task is not so easy. There is no explicit handle bound with drive (Unlocker or Sysinternals handle or even process explorer won't show anything) but still Windows will not allow to unmount such drive. Advice like logout, restart or kill explorer seems a little exaggerated and hard to accept.

I have these issues mostly on HDD external drives than mere pendrives.

With pendrives you can use eject function from Windows Explorer drives list. When there is no explicit process then it will work.

With external HDDs there is much harder because there is no eject function. And if you check processes you won't find any handles tangled with drive. In reality, even if not shown there is one process which is blocking drive - system with PID number 4. You can trace it with event logger where system will write information that system process under PID 4 did block the operation. You can check if drive wasn't added to SystemRestore monitor (it's one of the reasons).

For other cases I am using simple script and tool USB_Disk_Eject from Quick And Easy Software.

The batch script is:

sync
net share %1$ /D
USB_Disk_Eject /REMOVELETTER %1

I was experimenting with one additional command

fsutil volume dismount %1

but it seems I didn't add it to main batch (not sure why).

Sync is a small Sysinternals tool which will force your drives to finalize write operations (from drive cache to drive).

I had only one case where above lines didn't work - it was AVG software and only logout help.

1
  • I was thinking about one process to be traced but ok, maybe Mod idea is more correct.
    – KrzysztofJ
    Nov 15, 2021 at 12:09
-1

Restart Windows Explorer

Task Manager(Ctrl+Shift+Esc)

  • tab Details > explorer.exe > button End task
  • File > New Task > explorer
1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Nov 13, 2021 at 10:12

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .