My daughter had her thumb drive plugged into my desktop, doing some work. She finished, logged off of her account and I logged into mine. I noticed that she left her thumb drive in the USB port, and so I tried to safely eject it, but I get the following message:

Problem Ejecting USB Mass Storage Device

This device is currently in use. Close any programs or windows that might be using the device, and then try again.

OK, I give up. I just logged into my account and the first thing I did was try to eject her thumb drive. What in heck is currently using it? I don't have anything else opened/running when I got that message. How do I determine what program is apparently running and doing whatever it is, against that USB drive? How do I get whatever it is, to stop so I can safely disconnect the thing?


You can use Unlocker to find out what program has it opened, then close that program. If you cannot exit the program, you can use Unlocker to force the handle closed.

Unlocker showing processes with open handles

If it is Windows Explorer, you can restart it. En easy way is to hold Control + Shift and right-click a blank area in the Start menu:

Restarting Explorer in Windows 7

  • So how do you get the "exit explorer" context menu? – Moab Feb 8 '12 at 3:05
  • Oops, sorry. Fixed. (I don’t use that method; the few times I actually had to restart Explorer in Win7, I used an option called “Restart Explorer”. I can’t figure out where it is right now—I’m in XP at the moment—but next time I’m in 7, I’ll see if I can find it and add it as well. And no, it was not a third-party one that used taskkill, it was built-in, to my surprise—ie, Microsoft basically acknowledging the need to restart Explorer.) – Synetech Feb 8 '12 at 3:11
  • 1
    After exit of explorer using context menu, how do you get explorer to reload? ctrl+alt+del twice allows you to open task manager to do it, so it seems better to use task manager to exit explorer in the first place. – Moab Feb 8 '12 at 17:49
  • 1
    @DavidBalažic, have you tried the installed version? You could also try Handles or Process Explorer. If no open handles are being reported, then it could be open by a driver instead of by a program. In that case, you need to make sure to run the program (e.g., Process Explorer) as admin to see it. – Synetech Jan 2 '14 at 0:05
  • 1
    I edited this answer to point to the portable version hosted on Softpedia. "Several optional and usually unwanted software programs may be offered during the installation process. This can only be avoided by being careful not to click on the 'next' or 'install' buttons when the text reads e.g.: by clicking 'next' you agree to .... Instead the left button which is usually labelled cancel has to be chosen in order to continue with the regular installation." See deletedwikipedia.gawker-labs.com/wiki/Unlocker – Marc.2377 Jul 3 '16 at 3:10

The key is to identify the process that has a directory open on the device you need to unmount (I've used the following on Windows 7).

  • A search for warning Event ID 225 from Kernel-PnP in Windows Logs / System log file should find a message of the form "(something) stopped the removal or ejection for the device (something)".

This is already explained in the post:

Access "Computer Management" (right-click "Computer" / "Manage")

System tools -> Event viewer -> Windows Logs -> System

Use 'Find' to search for the event ID.

  • You can also install Process Explorer to perform a search for the process or application:

Use that utility to search for a handle with the target drive letter (for example f: ), available under Find / Find handle or DLL ... That will help identify the offending process / PID, (similar to use of 'lsof' command under Linux), and the process can be stopped manually (e.g. using Task Manager or Process Explorer). You may need to run Process Explorer as Administrator if you are not the owner of the process.

I've found that some apps keep the directory open, even after a file has been saved and closed. Sometimes it is enough to open another file from your C: drive to reset the "current" directory for the app. Also, apps may still be running after the window has been closed. The searches above will help identify which app you need to stop.

  • The system log is the only method that pointed out my anti-virus (NOD32) as the culprit, since Process Explorer and other programs can't "spy" on it. – Chema Apr 9 '19 at 4:27

Another option that does not require third party tools:

  1. Open "Disk Management" (aka "Create and format hard disk partitions")
  2. Locate the disk you want to eject from the lower-left stack of Disks.
  3. Right-click the disk and choose "Offline".
  4. You can then attempt again as normal to "Eject Device" from the system tray, which should now succeed.

enter image description here

One disadvantage to this approach is when you plug in again, you may have to go through the process to put the disk into Online mode.


Microsoft has its own utility called Devcon.exe.

From the site:

DevCon (Devcon.exe), the Device Console, is a command-line tool that displays detailed information about devices on computers running Windows. You can use DevCon to enable, disable, install, configure, and remove devices.

DevCon runs on Microsoft Windows 2000 and later versions of Windows.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.