Why doesn’t the Open Files list in the Shared Folders snap-in show all my open files?

A customer wanted a way to determine which users were using specific files on their server. They fired up the Shared Folders MMC snap-in and went to the Open Files list. They found that the results were inconsistent. Some file types like .exe and .pdf did show up in the list when they were open, but other file types like .txt did not. The customer asked for an explanation of the inconsistency and for a list of which file types work and which ones don't.

The customer is confusing two senses of the term open file. From the file system point of view, an open file is one that has an outstanding handle reference. This is different from the user interface concept of "There is an open window on my screen showing the contents of the file."

The Open Files list shows files which are open in the file system sense, not in the user interface sense.

Whether a file shows up in the Open Files list depends on the application that is used to open the file (in the user interface sense). Text files are typically opened by Notepad, and Notepad reads the entire contents of the file into memory and closes the file handle. Therefore, the file is open (in the file system sense) only when it is in the process of being loaded or saved.

There is no comprehensive list of which types of files fall into which category because the behavior is not a function of the file type but rather a function of the application being used to view the file. (If you open a .txt file in Word, I believe it will keep the file system handle open until you close the document window.)

The customer seemed satisfied with the explanation. They ran some experiments and observed that Hey, check it out, if I load a really big text file into Notepad, I can see it show up in the Open Files list momentarily. They never did come back with any follow-up questions, so I don't know how they went about solving the original problem. (Maybe they used a SACL to audit who was opening the files.)

Comments (30)
  1. Adam Rosenfield says:

    I had trouble parsing this post's title — I've never seen "snap-in" used as a noun before, so I kept trying to parse it as a verb and failing.  It makes sense after thinking about it, but it's a little atypical.

  2. Damien says:

    @Adam – it's a standard term for Microsoft Management Console. E.g. if you launch mmc (rather than a specific shortcut from Admin tools), the File menu offers "Add/Remove Snap-in…".

  3. Dan Bugglin says:

    If you want to track opened files, you can download and run Process Monitor and filter it for specific file operations or file types.  It will then log all operations and you can search through the collected log later.

    It's also worth noting processes always have an open handle on their working directory, and Explorer windows have a directory handle open on their currently viewed directory, so those are easily viewed in Open Files at any rate.

  4. SimonR says:

    I normally find it quite annoying when apps (such as Office) maintain file handles, as this blocks anything else from opening and viewing the file. I'd love to know why Office in particular does this.

  5. Adam Rosenfield says:

    Never used the Microsoft Management Console.  Even after opening it up, I can't figure out what its purpose is.  Is it a console for managing Microsoft?  Is it a Microsoft tool for managing consoles?†  The UI is not instructive.  I have to open up the Help Topics to get useful information: "Microsoft Management Console (MMC) hosts administrative tools that you can use to administer networks, computers, services, and other system components."

    There's some menu options that open up the Device Manager, Computer Management, and Services control panels.  Those are definitely useful, but why go through MMC to access them?

    † Those were rhetorical questions

  6. Mike Dimmick says:

    Adam Rosenfield: Those are not control panels. They are pre-configured Microsoft Management Console instances, the list of snap-ins and extensions being stored in an .msc file. "Device Manager" is an .msc file (devmgmt.msc) that only references one snap-in, Device Manager.

    The notion was to allow administrators to create their own consoles with all the tools they needed to do their jobs in one place.

    This is a good indication of why object-oriented applications – where the user puts together an application from a collection of objects supplied by third-parties – were utterly doomed to failure. Users just don't grasp the concept.

  7. Chris J says:

    @Adam … as per Mike Dimmick. I've found it useful and have made my own custom consoles before now; for example I can create an MMC view that includes four different event viewer snap-ins, each one looking at a different computer in a cluster. This way I can view the logs in one place rather than flip between views with Right-click -> connect to computer, and the view can be saved to disk so all I need to do next time is open the view.

    You'll note as well that Computer Management is a special snap-in that then includes other snap-ins, as from Computer Management you can get to Services and Event Viewer (amongst others), each of which are driven by their appropriate snap-in.

    To create a custom console, when you start MMC, go to File -> Add/Remove Snap-in … select the ones you want from the list, then you can just File -> Save the view you've created.

  8. metafonzie says:

    There is a connected trap with Shared Folders & Open Handles. I share media files on my large external USB drive over the network via SMB. Sometimes the USB drive cannot be ejected/'safely removed' when a media file was played recently over the network. It seems LanmanServer sometimes keeps the file handle active on a media file long after its has been served over the network (several hours) preventing the usb drive from being ejected. The only things that I found to work – restart the OS (safe) or restart the service (unsafe?).

  9. Ricardo C says:

    @metafonzie … That is a completely different matter. It is related to the HD write caching (delayed writing). You can set your portable device for quick removal. Visit support.microsoft.com/…/330174 for more information. There are also tools to flush the cache to disk (technet.microsoft.com/…/bb897438.aspx).

  10. Nick says:


    You asked Office to open the file, didn't you?  And you're keeping it open?  I don't understand how you can get upset at Office for holding a handle to a file that you asked it to open and haven't closed yet.

    Using Notepad's behavior as a baseline to compare to "real" programs is silly, because as everyone here should know: Notepad is just a glorified Edit control.



  11. metafonzie says:

    @Ricardo C

    Nope. I don't think so. Quick removal is irrelevant here because the problem has nothing to do with the filesystem cache. (When you manually call Eject on a USB drive, the OS flushes the cache anyway)

    In my usecase, I get an "Unable to eject, device in use" kind of error because a file handle is still kept open by the lanmanserver service.

  12. Joshua says:

    In my usecase, I get an "Unable to eject, device in use" kind of error because a file handle is still kept open by the lanmanserver service.

    Ah yes the reason why Unlocker was so loved. The data corruption was why it was so hated. Too bad there's no DuplicateHandle like API that takes the wanted value of the target handle or fixing it would be easy.

  13. voo says:

    @Nick: So taking notepad++ or UltraEdit (haven't used it for some time but I think it did the same) as baseline isn't better? Yeah sure those are also small editors and not much more than an edit control. I'm sure Visual Studio would never.. oh it does?

    So word is pretty much the odd one out there and I personally find the other behavior nicer as well.

  14. cheong00 says:

    @SimonR: I think it might be bacause Office team wants to have a way naturally telling SharePoint that a file is being used, so that could built functions such as "Open in Read Only mode while others editing the file" and "Notify me when the person locking file for edit released the lock".

  15. Anonymous Coward says:

    I always found it irritating that Notepad closes the file handle. The discrepancy between files that look open on screen and files that actually are open can cause a lot of problems.

    The most irritating one is where you open a file in Notepad, then move the file, then some time passes and you forget that you didn't reopen the file, and then you edit the file and save it and now it's back at its original location, the file at the new location is out of date <i>and there's nothing that tells you something went wrong.</i>

  16. juozas says:

    In the 5 years I've been reading this blog it's the first time I knew the explanation for customers problem before I read Raymond explain it. Am I getting smarter, or the entries more oriented towards dumb programmers like me?

  17. SimonR says:

    @Nick: Yes, I'm keeping a document open, but that doesn't mean I want to block it to everything else. I often encounter situations where I want more than one app to open a file simultaneously. Writing a program that reads a file, and I want to keep it open in Office to see what it's supposed to be reading. Looking simultaneously at a raw text view and the 'GUI' view. Or even wanting two different Word windows open, one on each monitor, to see different parts of a file.  Anonymous Coward points out the risk – that you do something to the file and end up with it out of date etc. But surely if I know what I'm doing and am prepared to take the responsibility, I should be able to? Perhaps the solution is for 'editors' to give users a choice whether to keep a handle to the file. But then perhaps many non-dev users would find that confusing?

  18. Neil says:

    The SBS 2003 MMC had everything you needed; as well as the Standard Management wizards it included the Active Directory Users and Computers, Group Policy Management, Computer Management, and Exchange snap-ins, plus four others I rarely used. But then SBS 2008 went back to kiddie mode, presumably for the reasons discussed above.

    The only time I've designed an .msc file is to allow people to be able to eject tapes remotely. (Eject buttons tend to fail.) The .msc file is configured to open directly at the appropriate drive, at which point Eject is just a right-click away.

  19. Justin says:

    @Anonymous Coward:  Actually I'm in the opposite position, I like that it doesn't keep the handle open than it needs to.  If there is a shared file or a file that is modified by an automated process then opening that file in an application that keeps handles open cab block others from using that file (Excel springs to mind) – I need to make sure that I keep the file open for as short a time as possible.

    If I open the same file in Notepad I know I can keep it open as long as I like without getting in anyone elses way and without the hassle of needing to copy the file elsewhere first.

  20. Ivo says:

    @AC: Imagine if all text editors kept the files open all the time. Now let's say you are editing a file in Visual Studio. You try to compile it: “fatal error C1083: Cannot open source file: '.Test.cpp': Permission denied”. Try it – open a cpp file in Word and compile it. Same can happen in Notepad if let’s say you are editing a config file for some program. You can’t run the program until you close Notepad.

    I sometimes edit CSV files with Excel, which are used by some build process. I can’t run the build until I close Excel and lose my undo history. Fail.

    <offtopic> And don’t get me started on how Excel can’t open two files with the same name. What if I want to open two versions of the same file to compare them side by side or copy from one to the other? Double fail.

  21. Ivo says:

    BTW, I love it how this forum software forgets your post the first few times. Every time you retype your post it gets better and more to the point. And Ctrl+Z? That's for sissies.

  22. Gabe says:

    Ivo: The comment box times out after a few minutes. Just routinely copy your comment and refresh (Ctrl+A, Ctrl+C, F5), then paste your text into the fresh comment box before posting. It will always work the first time.

  23. MattS says:

    @SimonR: keeping the file open does NOT automatically mean that other applications cannot access the file. That's what you've got dwShareMode parameter for CreateFile for: you (i.e. the programmer) can tell the system to open the file and block other applications from opening it for read, or only from opening it for write, or even only from deleting it. And you can open the file and allow other applications to do anything with it.

  24. Anonymous Coward says:

    @Simon R. &c: I just tried compiling a file that was open in Word, and it worked just fine.

    $ g++ /j/hello.cpp

    $ a.exe

    Hello world!

  25. Worf says:

    @MattS: Don't assume apps set that correctly – they are well known for asking more privilege than they really require, including exclusive mode for an app that only ever reads the file.

  26. SimonR says:

    @Anonymous Coward: I suspect a lot depends on the specific software. On quick testing, once I open a c# file in word, I can still open it in Notepad, but trying to csc it fails as can't open the file, as does trying to open it in Visual Studio.  Interestingly, the Word/VS issue is directional: I can open in Word while viewing in VS, but not the other way around.   I'm using Vista64/Word 2007/VS2008

  27. thepaulpage says:

    I would think that an easy fix would be a button (maybe even a hidden button) in office products that would close open file handles without closing the file.  Office team gets their sharepoint functionality, user can lose that feature at will.  

  28. Adam Rosenfield says:

    @MattS: That's true, but most programs don't call CreateFile directly.  They almost always go through the Microsoft C or C++ runtime, and the Microsoft implementations call CreateFile with the share mode set to exclusive.  You have to go out of your way and write platform-specific code to call CreateFile instead (or the fopen relative _fsopen, which lets you specify a sharing mode).

  29. Anonymous Coward says:

    @Adam: people shouldn't be using _fsopen, but _wfsopen since the former doesn't support Unicode. Sure, some headers #define this for you, but you have to make sure that it happens.

    @SimonR: opening a file in multiple editors ideally should fail, since otherwise you can get out-of-date, inconsistency and lost-edit problems. And obviously you've found a bug in csc.exe.

Comments are closed.

Skip to main content