Admin Tip #210: Process Explorer - which program has file, directory or registry key open

Hits: Failed to execute CGI : Win32 Error Code = 3


Mark Russinovich at www.sysinternals.com has released freeware utility Process Explorer (originally named HandleEX) which displays files, registry keys and other objects which processes have open, or which DLLs they have loaded. The GUI will show you who owns each process. Useful to Windows NT admin.

Ever wondered which program has a particular file or directory open? Now you can find out. HandleEx is a GUI/device driver combination that together show you information about which handles and DLLs processes have opened or loaded. Its display consists of two sub-windows. The top always shows a list of the currently active processes, including the names of their owning accounts, whereas the information displayed in the bottom window depends on the mode that HandleEx is in: if it is in handle mode you’ll see the handles that the process selected in the top window has opened; if it is in DLL mode you’ll see the DLLs that the process has loaded. HandleEx also has a powerful search capability that will quickly show you which processes have particular handles opened or DLLs loaded.

The unique capabilities of HandleEx make it useful for tracking down DLL-version problems or handle leaks, and provide insight into the way NT and applications work.



New Riders has good NT texts.