I have an external HDD which I would like to "safely remove". Unfortunately, my system (Windows 7 x64) complains that "the device is currently in use".

Using Process Explorer I discovered which process is holding a handle on the device:

Process Explorer Screenshot

Obviously, System is not a process that I can just kill and be done with it. I've done a bit of research and this seems to be a common problem, but no solution has been found so far (except for rebooting the machine, which I'd like to avoid if possible).

Is there any solution to this problem that I've missed?

  • haha yeah. rebooting may fix the problem but reboot suks. – apis17 Feb 19 '14 at 10:51
  • 3
    MS still haven't fixed this in Windows 10 – BeowulfNode42 Jul 26 '16 at 9:27

I've always had this problem with one of my Toshiba external drives. I value that drive really high because of its built-in shock detector, what is currently very hard to find. But the cannot-remove-it-safely issue was driving me crazy.

Today, I've hit this question/thread on social-technet MS site. While there's a lot of noise down there, they point out a few common issues. Like the Distributed-Tracking service. It's actually hard to read through it all due to some cohones-size-flame-war that escalated at some point, but reading the topic from its end helps;)

Anyways, sorry for my chatty mood, I've just fixed my case permanently.

I've got any Distributed-Tracking/Windows-Search/etc services off and was still unable to safely-unplug the drive. Someone somewhere suggested that "quick removal" is the culprit, but almost all my USB drives run on it and I still can remove them safely.

However, I actually tried switching this drive to "high performance mode" and .. it caused the TxfLogContainerXXXX handles to evaporate. So, it's true that this is the quick-removal option. However, this did not released my drive yet. Still couldn't eject it.

Then I have went to ComputerManagement->DriveManagement utility and I have removed any drive-letter assignements for that drive. Instantly afterwards, I was able to eject the drive.

Then I tried connecting it again, reassigning the drive letter, switching it to quick-removal and it seems to work properly and still be ejectable.

On the so-long topic on MS site, they also mention these actions. Someone suggested to:

  • change drive letters and reboot
  • or, try turning the drive "offline"

I think that the "turn the drive offline" via "computer management -> drive management" might actually be the quickest solution, however I have not tried it since my random attempts helped before I've read about that.

  • 1
    I had the same problem (caused by the same lock on \$Extend\$RmMetadata\$Txf), but in my case I was unable to dismount a TrueCrypt drive. I use Voidtools Everything and that process turned out to hold the lock. Solution: kill Everything before dismounting or make sure to have the drive mounted as a "removable medium" in the TrueCrypt settings. Files on that drive will then not be indexed by Everything. – mgr326639 Sep 11 '15 at 12:33
  • On Windows 8.1, I was able to change the drive letter, and then just eject the new drive letter from the system tray. Thanks. – Adrian Nov 5 '15 at 14:07
  • On Windows 7 x64, I was able to change the drive letter, and it ejected fine. – Contango Jan 9 '16 at 21:38
  • Couldn't put an external USB 3.0 drive offline as the option was greyed out (Windows 7 x64), but removing the assigned drive letter in Disk Management worked like a charm! Thanks! – lightproof Jun 3 '17 at 18:25

For me, the issue was caused by having file-content indexing turned on on the drive (which is on by default)

To disable it:

Right click the drive > Properties > Uncheck Allow files on this drive to have contents indexed in addition to file properties

After disabling contents indexing, I was able to eject the drive.

  • 2
    I just tried that. Half a day later, Windows Explorer is still walking through the files, unsetting this attribute on each and every one of them. Would it have sufficed to unset this attribute on the root directory of the drive? – Heinzi Jan 5 '17 at 16:59
  • Unfortunately, that this did not fix the issue for me: Just tried ejecting the device, same problem. – Heinzi Jan 10 '17 at 13:00

Five years later, I actually fixed this issue by resorting to a commercial tool: USB Safely Remove, which can "force stop" a device suffering from this issue. (Before that, I used the "take offline" workaround mentioned in quetzalcoatl's answer.)

Note: I am not affiliated with the creators of the software, I just mention them because their tool fixed the problem for me.


If your disk is set for quick removal (in drive policies) you should be able to safely unplug it without using the "safely remove" option.

I had the same error as Heinzi, but when I tried to solve it by changing the mode to "better performance", I noticed what the default option actually does :)

It sounds dangerous but perhaps without caching there really should be no worries?

BTW, my drive is a WD-500 and in drive management there is no option to turn drive offline.

  • 1
    The only worry is if some application decides to write to the disk at the time you eject it. Unless you know for sure that the process that has the handle to that drive is actually not going to write to the drive, it is a little risky. YMMV. – Adrian Nov 5 '15 at 14:09
  • @Spikolynn "Offline" option is available when you right-click the grey (leftmost) part of the Disk row. – sm4rk0 Jul 19 '17 at 10:35

Setting Removal policy to better performance from devmgmt.msc did not help for my 1TB Seagate Expansion Portable Drive. Only when i used services.msc to turn off "Crypkey License" it worked immediately.


Tried all of the other answers suggestions like changing/removing the drive letter, turning it offline, but those methods did not work.

I'd rather not play with toggling it's behavior and keep it set to quick removal.

USB Safely Remove did help, but maybe not directly when quickly clicking the drive in the main listing. When it showed me more than LockHunter would besides the *Metadata files in the root of the drive, there was also MsMpEng.exe operating on it. Forcing the stop of the files used by that process seemed to help me remove it.

For other drives or situations, I finally found Open Hardware Monitor seemed to have a lock on it, even when I haven't found other specific proof for that yet. I'd rather not close the program as I have to set my fan speed every time though.


I plugged in the USB flash drive before booting into windows 7 and I couldn't un-mout it (safely remove). After stopping the "Windows Search" service I could safely remove the drive. I only had the problem if the flash drive was connected to the computer before the Windows startup.

  • It seems OP problem is different from yours – Sam May 16 '17 at 8:03

protected by Community Apr 11 at 16:56

Thank you for your interest in this question. Because it has attracted low-quality or spam answers that had to be removed, posting an answer now requires 10 reputation on this site (the association bonus does not count).

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.