How to Use Resource Monitor to Find Locked Files & Disk Hogs

Every Windows user has encountered the frustrating dialog: "The action can't be completed because the file is open in another program." Windows doesn't tell you WHICH program is holding the file. Instead of restarting your PC or downloading shady "file unlocker" utilities, you can use the built-in Resource Monitor to instantly identify and terminate the lock.

Step 1: Launch Resource Monitor (resmon)

You can launch Resource Monitor in two quick ways:

Run Shortcut
resmon.exe

Press Win + R, type resmon, and press Enter. (Or in Task Manager > Performance tab, click the three dots / bottom link "Open Resource Monitor").

Step 2: Find the Locked File via Associated Handles

  1. In Resource Monitor, switch to the CPU tab.
  2. Look at the third section titled Associated Handles. Click the small arrow on the right to expand it.
  3. In the Search Handles search box, type the exact name (or part of the name) of the file or folder you cannot delete or move.
  4. Press Enter.
Instant Telemetry
Within 2 seconds, Resource Monitor lists the exact Process Name (e.g. excel.exe, explorer.exe, dropbox.exe, or node.exe) and the Process ID (PID) holding the active kernel lock.

Step 3: Release the File Lock Safely

1

Right-Click the Locking Process

Right-click the process name shown in the Associated Handles search results.

2

Select "End Process"

Click End Process. This instructs the Windows Kernel to release all open handles associated with that process.

3

Delete or Rename Your File

Return to File Explorer; you can now delete, move, or rename your file with zero restrictions!

Step 4: Diagnosing 100% Disk Usage in the "Disk" Tab

When Task Manager shows 100% Disk Usage, it doesn't show you the individual files being read or written. Resource Monitor's Disk tab reveals every single byte transferred:

  1. Click the Disk tab in Resource Monitor.
  2. Expand Processes with Disk Activity to see which .exe has the highest Total (B/sec).
  3. Expand Disk Activity below it. Sort by Response Time (ms).
Interpreting Disk Response Time
• Healthy NVMe SSD: 0.1 ms – 2 ms.
• Normal SATA SSD: 1 ms – 10 ms.
• Overloaded / Failing Drive: 100 ms – 5000+ ms.
If response time consistently exceeds 500 ms while transfer rates are tiny (under 1 MB/s), your drive is suffering from bad sectors, degraded flash controller firmware, or thermal throttling.

Bonus Feature: Spot Rogue Connections in the Network Tab

Click the Network tab > Listening Ports. This displays every port opened on your PC, the firewall status, and the exact software listening for inbound network connections.