The application system with process id 4 stopped the removal or ejection for the device

Being the great citizen I am, I left-click on the "Safely Rerelocate Hardware" symbol in my taskbar, and also pick my USB drive to dismount.

You watching: The application system with process id 4 stopped the removal or ejection for the device

Then I gain the message:

Windows can not sheight your Generic volume tool bereason it is in use. Cshed any programs or windows that could be utilizing the tool, and then attempt again later on.

Of course, being the Operating System, it knows exactly what applications are making use of my device. So why will not it tell me?

Or is tbelow a method that I have the right to find out?



You deserve to usage Sysinternals Process Explorer to discover the handle for any kind of files that are open. Just select the Find food selection and also pick Find Handle or DLL. In the dialog that opens up enter the drive letter right into the search box. The search results have to display every one of the records that are open from the drive and also which process has them open.


Simpler Method: Windows (10 at least, AFAIK) creates an entry in the event log as soon as you try to eject a removable drive and you cannot because a process has a lock on it. The two Event IDs 225 will present the process ID and also the name of the procedure responsible for the lock.

See more: Monster Hunter World Graphics Device Crashes, Fix Mhw Err12 Graphics Device Crashed Error

Tip by step:

1) Start the event viewer

2) Open up "Windows Logs" then "System"

3) Right click "System" and also pick "Filter Current Log"

4) In the dialog that comes up, enter "225" (without quotes) wright here it states "All Event IDs"

5) You will then see all occasions related to unable to eject because a procedure locked the drive.

6) Look at the timestamps on all these entries and find out which ones relate to the actual time once you tried to eject the drive.

7) Take appropriate action. Ending a job gracefully (cshedding the routine that has the lock) is OK many of the moment. Stopping the Windows Search business is likewise ok. Stopping an antivirus sdeserve to have to be ok (if you do not suspect you have actually any kind of virsupplies at the time). Going right into the task manager and killing the procedure might not be ok. How to deal with this is beyond the scope of this question.

See more: My New Pc Has Been Stuck In " Setup Will Continue After Restarting

8) (Save the check out...) in Actions panel (in the appropriate frame) you might "Save Filter to Custom View..." so you"ll uncover it in "Custom Views" (in the left framework over the "Windows Logs")

Process ID:


Process Name:


8) If you don"t have actually an additional entry via a procedure name, the System procedure (procedure id 4) is holding your drive. To acquire around this one you will have to go to disk monitoring and also put the drive you want to eject offline. If the file is on your boot drive, you can"t put it offline. In this instance, watch the note below:

UPDATE 2018: I"ve watched applications such as WhatsApp Deskoptimal maintaining handles on Chrome Canary via the System Process. Because you cannot eject the boot disk (beacuse it is in use), the solution wregarding usage an additional nifty Sysinternals energy, dubbed Handle. After you cshed the routine which has actually the locked file, launch take care of and run (as an example) handle64 "Chrome SxSApplicationchrome.exe" to see if the handles are still current on the file that has actually the PID 4 lock. Via trial and error, cshed each regimen running, till tbelow are no even more handles on the locked file.

Best method (paid)

Download and also run SafelyRerelocate. It helps you eject the drive and also if it can"t carry out it, it displays which procedures have a lock on it: