I have a WD 1TB Elements external hard drive, and every time I use the Windows 7 "safely remove" feature, it gives me a dialog telling that a process is using the disk.

Using Sysinternals Process Explorer and the answer on this Can Windows tell me what is using my USB drive? question, I get the following result:

Process Explorer "find" results

Process: System, PID: 4, Type: File, Names starting with E:\$Extend\$RmMetadata\$Txf

What is the $Extend folder and why is it in use? How can I disable it? I cannot remove it using the command line (access denied).

Edit: I've followed the instructions over here on Microsoft TechNet, and under the registry key


I have a multi-string value named IgnoreNTFS with data \$Extend\* /s.

But this does not make any difference. Also, this question is not about a server.

Additionally I can tell that I use a program called mkv2vob to convert video files with a Matroska container into something my PS3 will play. I convert the source files straight from my external HDD, but I would expect if this program does not release the lock on the HDD, surely it cannot be locked if the process isn't even running?

  • I've had the same problem on my Vista laptop. I looked for programs using the drive but couldn't find any. So what I do is sleep the box. Ten seconds after the box goes to sleep I can hear the drive shut down, at which point I unplug it. Been doing this daily for months with no problems. Dec 1, 2012 at 13:47
  • 1
    Possible duplicate of Safely remove external USB drive fails due to $extend
    – janot
    May 17, 2016 at 12:28

11 Answers 11


As explained by Rook in this answer: https://superuser.com/a/674255/142560

To safely remove the drive:

  1. Open Command Prompt (cmd.exe).
  2. Type diskpart.
  3. Type list disk.
  4. Find your disk #, and type select disk [number here].
  5. Type offline disk.

You should be able to remove it now.

Next time you plug it in, it won't be automatically mounted. So either use the command prompt again to make it online, or:

  1. Run diskmgmt.msc.
  2. Find the disk, right click, and choose "Online".
  • 1
    +1 i've had fsutil resource stop f:\ work in the past and no doubt will in the future, but this time, fsutil didn't work, and after every attempt to dismount it was locking, this worked for me. So it makes for a good second step if fsutil doesn't do the job.
    – barlop
    Jul 14, 2015 at 9:28
  • heh, this time I get that error even after choosing offline then choosing to remove the drive!
    – barlop
    Dec 1, 2015 at 0:35
  • just tried it , fsutil resource stop, now.. and it worked and also removed the drive from the safely remove tray thing, don't think i've seen the latter before but ok.
    – barlop
    Jun 21, 2016 at 9:42
  • 7
    In most cases you can directly after execute offline disk execute online disk and the volume can still be unmounted using the tray icon. This has the advantage that next time you plug it in, it will be automatically mounted as usual.
    – Robert
    Jun 20, 2017 at 12:42
  • Thanks. I put the hard drive offline and then immediately online again. (diskmgmt.msc) I could remove it then.
    – kapsiR
    Mar 1, 2019 at 10:00

Got the same problem with a different external disk used for backup of the system disk. I identified the TxF file locks using LockHunter, which wasn't able to unlock them.

I hear Transactional NTFS is used by autoupdate, but have no clue why the system would want to place this on an external disk and then be unable to stop it upon safe removal request. Fsutil resource info doesn't show any activity.

Try in the cmd console:

fsutil resource stop E:

or, if it doesn't help,

fsutil resource setautoreset true

and reboot. You can also try stopping a TxF-related service in Computer Management / Services

  • fsutil resource stop E: worked for me. Thanks! Feb 16, 2021 at 1:29
  • The handles are closed, but disk still cannot be ejected. There is 0 write/read operations done to the disk. 0 Handles. Disk is still constantly spinning and cannot be ejected. I'm starting to go mad. Oct 2, 2023 at 5:40

I have had this same issue every time I used my external USB drive to my Win 8.1 desktop. The only way I could properly eject it was by going into Disk Management and then taking the disk offline. It's really painful though as you then have to put it online when you next plug it in.

But, just today I went into the disk's Device Properties (from Device Manager or from the Hardware tab in any disk's properties dialog) and found that the the disk's Removal policy was set to Quick removal:

Quick removal

Disables write caching on the device and in Windows, but you can disconnect the device safely without using the Safely Remove Hardware notification icon.

The other option is:

Better performance (default)

Enables write caching in Windows, but you must use the Safely Remove Hardware notification icon to disconnect the device safely.

Just out of curiosity I changed the removal policy to Better performance and sure enough after I did that the Safely Remove Hardware eject function worked fine and I could eject the disk without the dreaded "Disk is in use" error. I have no idea why the policy would make any difference since I was trying to safely remove either way but I haven't had any problems since so give it a try.

  • When I still had the disk, I was pretty sure I had it in performance mode. Actually I'm pretty sure that quick removal is default. I'm not too lazy to use the eject feature which is why I went for increased performance, and yet I couldn't use eject (IIRC).
    – MarioDS
    Sep 4, 2014 at 14:36
  • This seems to have done the trick for me, and is much easier than taking the disk offline. I'm more comfortable using Safely Remove Hardware with a hard disk anyway. Mar 26, 2015 at 0:58
  • It doesn't work for me. It removes the handles to the drive.. so process explorer shows no handles, and then I thought ah now it'll work. But when I chose to remove the drive, then I got that same error. And then process explorer shows handles rmmetadata handles on it. It did say that it needs a restart after that setting though. And I haven't restarted.
    – barlop
    Dec 1, 2015 at 0:32

Windows 7 is trying to Backup to your external Hard drive, You can disable backups to external disk drive. Sample solution is here.

  • 1
    it's a windows feature. I don't know why did windows do something like this. Nov 26, 2012 at 20:29
  • Okay I just got this again. Exactly same window as in original question.
    – MarioDS
    Nov 29, 2012 at 21:45

I had a similar problem, on my Windows 10 20H2, so I decided to share my solution here, because this page was most useful in looking for it.

After copying files from/to an external HDD through the explorer, everything was OK. But after copying files through the Total Commander, i couldnt "safely remove" HDD, it gives me a dialog telling that a process is using the disk.

Sysinternals Process Explorer showed the same result as in this question, it was Transactional NTFS.

Process: System

$Extend$RmMetadata$Txf:$I30:$INDEX_ALLOCATION $Extend$RmMetadata$TxfLog$TxfLogContainer00000000000000000002 $Extend$RmMetadata$TxfLog$TxfLogContainer00000000000000000001 $Extend$RmMetadata$TxfLog$TxfLog.blf

But when i used LockHunter, it showed, that two processes block my HDD: System and MsMpEng.exe. MsMpEng.exe was not displayed in Windows Task Manager and Sysinternals Process Explorer, just in LockHunter! MsMpEng.exe is main background process of Windows Defender. I disabled Windows Defender - it is rather hard in Windows 10, but i used program Rubilnik by Flibustier (now the last version is 1.8), that does it in one click, and everything became OK. No problems with "safely remove".


  • One of the processes, that can block "safely remove" is Windows Defender.
  • Use LockHunter to detect blocking process, it is one of the best programs for it.
  • Use other different programs to detect blocking process, because some processes are not displayed in some programs.
  • And, if you disable Windows Defender, don't leave your computer unsafe - install other antivirus program.
  • Same story here. Sysinternals Proc Explorer only showed system handles. I even stopped the system NTFS journaling for the drive by using fsutil resource stop F:, this closed all the handles in Process Explorer (0 handles for the drive), yet still disk F: couldn't be ejected. I then went into Event Viewer and checked system. Oh, and look at that! There was 2 (!) processes blocking the drive ejection. System and... LightingService.exe (this is ASUS AURA RGB lighting service). After I killed it, drive was finally ejected... So the System is not a problem. I have 0 idea why AURA... Oct 2, 2023 at 6:00
  • ... uses all the freaking external HDD drives, and what it did to this drives. But the drive was constantly spinning, with 0 read/write activity on the drive itself reported by Task Manager... No comments... Oct 2, 2023 at 6:02
  • And also, don't use "antivirus" programs. "Antiviruses" are the REAL viruses. They hang in your memory, waste HDD space, waste RAM, waste CPU, does some stuff to your files you are not aware about. I, personally, never used "antivirus" in 3 or 4 years, and never had ANY problem whatsoever. I also never updated Windows 10 in 3 years and have 0 problems too. Just use your brain, don't use shady sites, don't fall for phishing. No need for any "antiviruses" then. Unless you are some kind of secret government agent that is being hunted, of course! Oct 2, 2023 at 6:07

I've recently discovered that restarting the "Server" service (which will generally require Windows to also restart dependent "Computer Browser" service and possibly the "HomeGroup Listener" service at the same time) allows me to then safely remove the drive. I don't know if this is actually safe to do or not, but it does work.

  • This worked for me. I feel that this looks like safer than fsutil and TxS functionality as the consequences are pretty vague. Any ideas on this? Sep 21, 2018 at 17:49

For me, this issue was related to a program called Everything.exe. Similar to the original poster, I discovered that my system PID: 4 had multiple files in use, preventing me from ejecting my external USB hard drive:





Closing Everything.exe released these locked connections to my HD and I can safely eject now with no problems. (Everything.exe is a freeware NTFS indexing search program created by VoidTools.)

  • 2
    Unless it's the case that process explorer didn't show that, and you state that, then this is not useful and not necessarily answering the question. Clearly various programs can cause it, almost any that are using the drive can cause it. To answer the Q it has to be that the program isn't listed in process explorer.
    – barlop
    Jun 21, 2016 at 9:46
  • @barlop I don't see the point in your comment. The answer is valid as it exactly describes a possible solution for the situation shown in the question.
    – Robert
    Nov 6, 2017 at 19:45
  • @Robert you may be right.. as his also showed PID=4. I wonder what made him consider closing everything.exe BTW I used to use everything by voidtools, I think I stopped 'cos the index wasn't updating..I recall it reigniting my interest in computers. I might start using it again
    – barlop
    Nov 7, 2017 at 1:33

For me, this was the solution: Windows Task Manager may prevent safe removal of USB drive (I am on Windows Server 2016, winver 1607.)

The problem was solved by closing task manager. Then the USB drive could be removed safely.

That blog post and the second answer in the question you linked has a different method for checking what stopped ejection that was more helpful and could have solved my problem:

Windows (10 at least, AFAIK) creates an entry in the event log when you try to eject a removable drive and you cannot because a process has a lock on it. The two Event IDs 225 will show the process ID and the name of the process responsible for the lock.

  1. Start the event viewer. (eventvwr.msc)
  2. Open up "Windows Logs" then "System".
  3. If you don't see the error in the first few results, see the full answer for a guide on searching for it and bookmarking the search for later.

This doesn't resolve your core issue, but it is too long for a comment and answers one part of your question.

'What is the $Extend folder and why is it in use?

The $Extend folder is used by windows to store various things relating to the NTFS filing system such as quota information and NTFS log files. See this MSDN article for more info.

In your case you are interested in the \$Extend\$RmMetadata folder which is part of the Transactional NTFS system. This is an essential part of windows and can't be disabled, although I would have expected that you can disable it for one particular drive, but unfortunately I don't know how.

There is a command line program called fsutil which can be used to display some information about these files (eg fsutil resource info e: and fsutil transaction list which perhaps could indicate which process is using this feature. There are other commands to start and stop the resource manager, but I'm not going to recommend that as I don't know the consequences, but it might give you a starting point to research further.

By the way, the instructions you are following re the Backup aren't really relevant to your situation. They only apply if you are actually running a backup and the backup is failing because these files are locked and the solution is just to configure the backup to ignore these files.


The System, usually, is not the culprit in this case. $TxfLogContainer00000000000000000002 and other NTFS log handles are not, in fact, the reason for this problem. Sysinternals Process Explorer will usually fail to notice handles opened by background processes that actually block the drive. Or there might be no handles opened at all, yet still the process can block the USB drive.

To find out what process is the actual culprit do this:

  1. Press WIN + R
  2. Launch eventvwr.msc
  3. Open Windows Logs -> System
  4. Examine latest warnings that state The application ... with process id x stopped the removal or ejection for the device USB ...

enter image description here

You will probably find System in there, but again, you can only suspect the System if it is the only one among this warnings. In my case, the actual culprit was LightingService.exe process. It is a part of ASUS AURA RGB lightning control software. I have no idea why it was blocking the drive. The disk had 0 write/read activity, but it was still spinning constantly without stopping. Maybe it tried to control the "RGB" on the drive? It seems that other people had the same problem, so this is a critical bug in a driver software that was never fixed.

The irony in this story, is, that I was blaming Windows for this bug all along. But it turned out, faulty 3rd party software was the culprit. Bizarre.

  • Please do not post the same answer to multiple questions. If the same information really answers both questions, then one question (usually the newer one) should be closed as a duplicate of the other. You can indicate this by voting to close it as a duplicate or, if you don't have enough reputation for that, raise a flag to indicate that it's a duplicate. Otherwise tailor your answer to this question and don't just paste the same answer in multiple places.
    – DavidPostill
    Oct 2, 2023 at 11:09


points to the "Distributed Link Tracking Client has gone nuts and is groveling the entire hard drive for who knows what reason. After stopping the service, I was able to eject the hard drive. For this sort of problem, you can get more information about which service svchost.exe is hosting is behind the activity by looking at the stack for a relevant item in the Sysinternals Process Monitor list. I found trkwks.dll in the stack, which is "Distributed Link Tracking Client"


64 Windows users found this to be their solution, more popular than any other solution ever provided at answers.microsoft.com

note MS supposedly removed this service for later editions of Windows https://support.microsoft.com/en-us/kb/312403 Distributed Link Tracking on Windows-based domain controllers

  • This answer does not appear to answer the author's question. You also have reference links which you failed to properly cite and quote all relevant information.
    – Ramhound
    Jan 5, 2017 at 22:57

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .