OPENFILES Command Guide - Query and Manage Open Files

The openfiles command is a Windows Command Prompt utility that queries, displays, and disconnects files and folders opened by network users on shared resources. It also enables or disables the system global flag "Maintain Objects List" to track local file usage, providing administrators with a complete view of all open file handles across the system.

Whether you're troubleshooting locked files preventing deletion or modification, identifying which network user has a shared document open, managing file server resources, or diagnosing "file in use" errors, openfiles delivers the file handle visibility that standard Windows tools often lack. System administrators and IT professionals rely on this command for file server management, resource monitoring, and resolving file contention issues across enterprise network shares.

This comprehensive guide covers openfiles syntax, all parameters and output modes, local file tracking configuration, practical examples for common scenarios, troubleshooting file lock issues, related system administration commands, and frequently asked questions. By the end, you'll confidently manage open file handles from the command line for network administration, file server maintenance, and access troubleshooting tasks.

What Is the Openfiles Command?

The openfiles command provides administrators with visibility into files that are currently opened by processes or network users. It operates in two distinct modes:

Network mode (default): Queries and manages files opened by remote users via network shares. This works out of the box without additional configuration and shows files accessed through SMB/CIFS shares.
Local mode (requires enabling): Tracks files opened by local processes on the machine itself. This requires enabling the "Maintain Objects List" system flag and a reboot.

The command is particularly valuable for file server administrators who need to:

Identify who has a file open when other users report "file in use" errors
Forcefully disconnect remote file handles to unlock files for maintenance
Monitor file server usage and identify heavily accessed shared resources
Troubleshoot access conflicts in multi-user environments

Openfiles works in Command Prompt (CMD) and Windows PowerShell with administrator privileges. It is available in Windows 10 Pro/Enterprise, Windows 11 Pro/Enterprise, Windows Server editions, and Windows 7/8 Pro editions. The command is not available in Windows Home editions. Changes to the local tracking flag require a system restart to take effect.

Important: Forcefully disconnecting open files can cause data loss if the user has unsaved changes. Always attempt to notify users before disconnecting their file sessions. Enabling local file tracking adds a small performance overhead to the system.

Openfiles Command Syntax

The command has three operational modes:

Query Mode

openfiles /query [/s computer] [/u domain\user /p password] [/fo {TABLE|LIST|CSV}] [/nh] [/v]

Disconnect Mode

openfiles /disconnect [/s computer] [/u domain\user /p password] [/id openfileID] [/a accessedby] [/o openmode] [/op openfile]

Local File Tracking

openfiles /local [on|off]

Parameters and Switches

Parameter	Description
`/query`	Display all open files from network shares (default action)
`/disconnect`	Disconnect one or more open files by ID, user, or filename
`/local`	Enable or disable local file object tracking (requires restart)
`/s computer`	Specify the remote computer to query or manage
`/u domain\user`	Run the command with alternate user credentials
`/p password`	Password for the specified user account
`/fo format`	Output format: `TABLE` (default), `LIST`, or `CSV`
`/nh`	Suppress column headers in TABLE or CSV output
`/v`	Verbose output—includes additional details like hostname
`/id openfileID`	Disconnect the file with the specified numeric ID
`/a accessedby`	Disconnect all files opened by the specified username
`/o openmode`	Disconnect files by open mode: `Read`, `Write`, or `Read/Write`
`/op openfile`	Disconnect files matching the specified open file name or path

If you run openfiles without any switches, it defaults to /query mode and displays all network-opened files on the local machine.

Enabling Local File Tracking

By default, openfiles only tracks files opened over the network (SMB shares). To also monitor locally opened files, you must enable the system global flag:

Enable Local Tracking

openfiles /local on

After running this command, restart the computer for the change to take effect. Once enabled, openfiles /query displays both network-opened and locally-opened files.

Disable Local Tracking

openfiles /local off

Restart required. Disabling removes the performance overhead of tracking local file handles.

Check Current Status

openfiles /local

Displays whether local file tracking is currently enabled or disabled without making changes.

Performance note: Enabling local file tracking adds overhead because Windows must maintain an internal list of all open file objects. On systems with heavy file I/O (database servers, build servers), this overhead can be noticeable. Enable only when actively troubleshooting.

Practical Openfiles Command Examples

Display All Network-Opened Files

Show all files currently opened by remote users via network shares:

openfiles /query

Expected output:

Files opened remotely via local share points:
---------------------------------------------
ID    Accessed By    Type    Open File (Path\executable)
====  =============  ======  ==========================
3     JSmith         Windows C:\SharedDocs\report.docx
7     AJohnson       Windows C:\SharedDocs\data.xlsx
12    JSmith         Windows C:\Backup\config.xml

ID: Unique identifier for each open file session. Accessed By: The username that opened the file. Type: Connection type (Windows = SMB). Open File: Full path to the opened file.

Display Open Files in CSV Format

Export open files data to CSV for analysis in Excel or scripts:

openfiles /query /fo csv

Output:

"ID","Accessed By","Type","Open File (Path\executable)"
"3","JSmith","Windows","C:\SharedDocs\report.docx"
"7","AJohnson","Windows","C:\SharedDocs\data.xlsx"

Redirect to a file for logging: openfiles /query /fo csv > C:\Logs\openfiles.csv

Display Open Files in Verbose Mode

Show additional details including hostname information:

openfiles /query /v

Verbose mode adds the hostname column, useful for identifying which computer initiated the file access.

Disconnect a Specific File by ID

Close a specific file handle using its ID number:

openfiles /disconnect /id 3

Expected output:

SUCCESS: The connection to the open file "C:\SharedDocs\report.docx" has been terminated.

The user will lose access to the file immediately. Any unsaved changes in the user's application will be lost.

Disconnect All Files for a Specific User

Close all open file handles for a particular user:

openfiles /disconnect /a JSmith

This disconnects every file that JSmith has open through network shares. Useful when a user's session is hung or the user account needs immediate access revocation.

Disconnect Files in Read/Write Mode

Disconnect only files opened in Read/Write mode (preserving read-only connections):

openfiles /disconnect /o "Read/Write"

This selectively closes write-locked files while allowing read-only access to continue. Useful when you need to unlock files for modification without disrupting all users.

Disconnect a Specific File by Path

Close all handles to a specific file regardless of who opened it:

openfiles /disconnect /op "C:\SharedDocs\report.docx"

Disconnects every user's connection to the specified file. Use when a specific file is locked and needs to be freed for editing, backup, or deletion.

Query Open Files on a Remote Server

Check open files on a remote file server:

openfiles /query /s FILESERVER01 /u DOMAIN\Admin /p P@ssw0rd

Queries the remote server FILESERVER01 using domain admin credentials. Essential for managing multiple file servers from a central administrative workstation.

Disconnect Files on a Remote Server

Disconnect a locked file on a remote file server:

openfiles /disconnect /s FILESERVER01 /u DOMAIN\Admin /p P@ssw0rd /op "D:\Shares\Finance\quarterly.xlsx"

Remotely frees the file handle on the target server without requiring RDP access to the server console.

Monitor Open Files with Periodic Refresh

Create a simple monitoring loop in a batch file:

@echo off
:loop
cls
echo === Open Files Monitor === %date% %time%
openfiles /query
timeout /t 30
goto loop

This refreshes the open files display every 30 seconds, providing near-real-time visibility into file server usage.

Common Use Cases for the Openfiles Command

Resolving "file is locked" errors – When users report they cannot edit a shared document, use openfiles /query to identify who has the file open and openfiles /disconnect /id N to release the lock after coordinating with the locking user.
File server maintenance and cleanup – Before performing backups, migrations, or maintenance on shared folders, query open files to identify active connections that must be closed or notified before proceeding.
Identifying abandoned file sessions – Users who disconnect from VPN or go home without saving leave file handles open. Use openfiles to find and clean up these orphaned sessions that prevent other users from editing.
Security auditing and access monitoring – Track which users are accessing specific shared files for compliance auditing. Export to CSV format for detailed analysis: openfiles /query /fo csv > audit_log.csv.
Troubleshooting file deletion failures – When del or Windows Explorer cannot delete a file with "file in use" error, openfiles reveals which process or user has the file handle open.
Managing file server capacity – Monitor the number and distribution of open files to identify heavily-loaded shares, peak usage times, and bottleneck resources on file servers.
Emergency user access revocation – When an employee account needs immediate access removal, openfiles /disconnect /a username closes all their open file handles before disabling the account.
Pre-migration file handle cleanup – Before migrating file shares to new servers, query and disconnect all open files to ensure clean data transfer without locked file errors during robocopy or DFS migration.
Diagnosing application file locking – Some applications open files in exclusive mode unnecessarily. Use local file tracking to identify which processes hold locks and troubleshoot application behavior.
Monitoring backup job conflicts – Backup software often fails on locked files. Schedule openfiles queries before backup windows to proactively identify and resolve locking conflicts.
Remote file server administration – Manage open files on multiple file servers from a central workstation using /s parameter without requiring RDP sessions to each server.
Generating file access reports – Periodically capture open files data to CSV for trend analysis, capacity planning, and user activity reports in enterprise environments.

Tips and Best Practices

Warning before disconnecting – Always attempt to contact the user before forcefully disconnecting their files. Unsaved work in applications like Word, Excel, or CAD software will be lost permanently.
Use CSV output for logging – Pipe openfiles output to CSV files for historical records: openfiles /query /fo csv >> C:\Logs\openfiles_%date%.csv. This helps identify patterns and recurring issues.
Enable local tracking temporarily – Only enable /local on when actively troubleshooting. The performance overhead is unnecessary for routine monitoring of network-opened files.
Restart required after /local changes – Remember that enabling or disabling local file tracking requires a full system restart. Plan this change during maintenance windows.
Combine with net session for complete picture – Use net session to see connected users and openfiles /query to see which files they have open. Together, they provide complete file server session visibility.
Automate monitoring with scheduled tasks – Create a Windows Scheduled Task that runs openfiles /query /fo csv >> log.csv every 5 minutes for continuous monitoring without manual intervention.
Use /nh for scripting – The /nh (no header) switch removes column headers from output, making it easier to parse in batch scripts or PowerShell: openfiles /query /fo csv /nh.
Disconnect by open mode for selective cleanup – Use /o Read/Write to disconnect only write-locked files, preserving read-only access for users who are just viewing documents.
Always run as Administrator – Openfiles requires elevated privileges for all operations. Right-click Command Prompt and select "Run as administrator."
Check Windows edition compatibility – Openfiles is not available in Windows Home editions. Verify you're running Pro, Enterprise, or Server editions before relying on this command.
Use with Computer Management GUI – The Computer Management console (compmgmt.msc) → Shared Folders → Open Files provides a graphical alternative. Use openfiles CLI for scripting and automation.
Monitor file server during peak hours – Run openfiles queries during peak business hours to identify capacity issues, heavily contested files, and opportunities for workflow improvements.

Troubleshooting Common Issues

"INFO: No open files found" Message

Problem: Openfiles returns "No open files found" even though users report accessing shared files.

Cause: No files are currently opened via network shares, or the query is running on the wrong server. If checking local files, the "Maintain Objects List" flag may not be enabled.

Solution:

Verify users are accessing files through network shares (mapped drives or UNC paths), not local paths
Run openfiles /local to check if local tracking is enabled (for local file queries)
If targeting a remote server, use /s servername to query the correct file server
Verify the file sharing protocol (SMB) is being used—openfiles doesn't track other protocols

Prevention: Document which server hosts each shared folder. Enable local tracking on workstations only when troubleshooting specific issues.

"The system global flag 'maintain objects list' needs to be enabled"

Problem: Running openfiles /query with local tracking shows this error instead of results.

Cause: Local file tracking is not enabled. By default, openfiles only tracks network-opened files.

Solution:

Run openfiles /local on as Administrator
Restart the computer for the change to take effect
After restart, run openfiles /query again

Prevention: Remember the restart requirement. Plan to enable this during a maintenance window rather than in the middle of active troubleshooting.

Cannot Disconnect Files on Remote Server

Problem: openfiles /disconnect /s ServerName fails with "Access denied" or connection errors.

Cause: Insufficient permissions on the remote server, firewall blocking RPC connections, or Remote Registry service is not running on the target server.

Solution:

Use domain admin credentials: /u DOMAIN\Admin /p password
Ensure Windows Firewall allows Remote Administration on the target server
Start the Remote Registry service on the target: sc \\ServerName start RemoteRegistry
Verify network connectivity with ping ServerName

Prevention: Configure firewall rules for remote administration. Ensure Remote Registry service is set to Automatic on file servers.

Performance Impact After Enabling Local Tracking

Problem: System performance degrades noticeably after running openfiles /local on and restarting.

Cause: The system is maintaining an internal list of every open file object, which adds overhead proportional to file I/O activity. High-I/O systems (database servers, build servers) are most affected.

Solution:

Complete your investigation quickly and disable local tracking: openfiles /local off
Restart the server to remove the overhead
For ongoing monitoring, use Sysinternals Process Monitor or Handle.exe instead—they don't require global flag changes

Prevention: Use local tracking only for targeted troubleshooting sessions. Never leave it enabled permanently on production servers with heavy I/O.

File Still Locked After Disconnect

Problem: After openfiles /disconnect, the file remains locked and inaccessible.

Cause: Multiple sessions have the file open, a local process (not network) holds the lock, or the application cached the file handle and hasn't released it.

Solution:

Run openfiles /query again to check for remaining open handles
Disconnect all matching files: openfiles /disconnect /op "path\filename"
If a local process holds the lock, use Sysinternals Handle.exe or Process Explorer to identify and close it
As a last resort, restart the file server service or the server itself

Prevention: Investigate why multiple locks exist. Train users to close files when not actively editing.

Related Commands

net file – Legacy Open Files Management

net file is the predecessor to openfiles for managing files opened on network shares. It displays file IDs and can close specific file locks with net file ID /close. While still available, openfiles provides more filtering options, output formats, and remote management capabilities.

When to use net file: Quick file lock release when you know the file ID. Simpler syntax for basic operations.

net session – Display Network Sessions

net session shows all active SMB sessions connected to the local machine, including the user, computer name, and idle time. Combined with openfiles, it provides complete visibility into who is connected and what they're accessing.

When to use net session: To see who is connected to the server. Use openfiles to see what files they have open.

handle – Sysinternals File Handle Utility

Handle.exe (from Sysinternals) shows all open handles for every process on the system without requiring the "Maintain Objects List" flag. It identifies local processes holding file locks that openfiles cannot see without local tracking enabled.

When to use handle: When openfiles doesn't show the expected file lock because it's held by a local process, not a network session.

taskkill – Terminate Processes

taskkill terminates processes by name or PID. When a local process holds a file lock that cannot be released through openfiles, terminating the process with taskkill /f /im processname.exe releases all its file handles.

When to use taskkill: As a last resort to free file locks when the process holding the lock is identified but unresponsive.

net share – Manage Network Shares

net share creates, deletes, and displays information about shared network resources. Combined with openfiles, it provides complete file sharing administration—net share manages the shares themselves while openfiles manages the files opened through those shares.

When to use net share: To check share configurations, permissions, and paths alongside open file investigations.

Frequently Asked Questions

What does the openfiles command do?

The openfiles command queries, displays, and disconnects files opened by network users via SMB/CIFS shares on Windows. It can also enable local file tracking to monitor files opened by local processes. Administrators use it to find locked files, disconnect user sessions, and monitor file server usage.

How do I find who has a file open in Windows?

Run openfiles /query as Administrator to list all files opened via network shares along with the username accessing each file. For a specific file, check the output for the file path. If the file is locked by a local process, enable local tracking first with openfiles /local on and restart.

How do I unlock a file locked by another user?

First, identify the lock with openfiles /query. Note the ID number. Then disconnect with openfiles /disconnect /id N (replace N with the ID). You can also disconnect by username (/a username) or by file path (/op "path\filename"). Warn the user first—unsaved work will be lost.

What is the "Maintain Objects List" flag?

The "Maintain Objects List" is a Windows system global flag that enables tracking of all locally-opened file objects. By default, only network-opened files are tracked. Enable it with openfiles /local on for local file monitoring, but be aware of the performance overhead (requires restart).

Does openfiles work on Windows Home editions?

No, openfiles is only available on Windows Pro, Enterprise, Education, and Server editions. Windows Home lacks this command. For Home users, third-party tools like Sysinternals Process Monitor or Handle.exe provide similar functionality for identifying file locks.

How do I check open files on a remote server?

Use the /s parameter with credentials: openfiles /query /s SERVERNAME /u DOMAIN\Admin /p Password. This queries the remote server's open files from your local machine. The Remote Registry service must be running on the target server and firewall rules must allow remote administration.

Can openfiles show locally opened files?

By default, openfiles only shows files opened over the network (SMB shares). To track locally-opened files, run openfiles /local on as Administrator and restart the computer. After restart, openfiles /query shows both network and local file handles.

What is the difference between openfiles and net file?

Both manage network-opened files, but openfiles is the modern replacement with more features: CSV/LIST/TABLE output formats, remote server management, wildcard filtering by user or file, and local file tracking. net file offers simpler syntax (net file ID /close) for basic operations.

How do I disconnect all open files for a user?

Run openfiles /disconnect /a username to close all file handles opened by the specified user across all shared resources. This is useful for emergency access revocation or cleaning up abandoned sessions from disconnected users.

Why does openfiles show no results?

Common causes: no files are currently opened via network shares, you're querying the wrong server, you need to enable local tracking for local files (openfiles /local on), or you don't have administrator privileges. Always run CMD as Administrator and verify you're querying the correct file server.

Can I use openfiles in a batch script?

Yes, openfiles supports CSV output and no-header mode for scripting: openfiles /query /fo csv /nh. You can redirect output to files, pipe to findstr for filtering, and use the exit code to determine if open files exist. Example: openfiles /query /fo csv | findstr "report.docx".

Does disconnecting a file corrupt it?

Disconnecting a file closes the SMB session handle but doesn't corrupt the file data on disk. However, the user's application may lose unsaved changes and could display errors. Applications with auto-save features (like modern Office) may recover partial changes. Always warn users before disconnecting.

Quick Reference Card

Command	Purpose	Example Use Case
`openfiles /query`	List all network-opened files	See who has files open
`openfiles /query /fo csv`	Output in CSV format	Export for analysis
`openfiles /query /v`	Verbose output with hostname	Detailed monitoring
`openfiles /disconnect /id 3`	Disconnect file by ID	Free a specific locked file
`openfiles /disconnect /a JSmith`	Disconnect all user files	Revoke user access
`openfiles /disconnect /o "Read/Write"`	Disconnect write-locked files	Selective lock release
`openfiles /disconnect /op "path"`	Disconnect by file path	Free specific file
`openfiles /local on`	Enable local file tracking	Monitor local processes
`openfiles /local off`	Disable local tracking	Remove performance overhead
`openfiles /query /s SERVER`	Query remote server	Manage file servers remotely

Try the Openfiles Command in Our Simulator

Practice the openfiles command safely in our Windows Command Simulator. No installation required—run openfiles /query, test disconnect operations, and explore all parameters in your browser without affecting your file server. Perfect for learning, IT certification prep, and demonstrating file management concepts in training environments.

Visit the Commands Reference for a full list of supported Windows CMD commands, including system administration tools like tasklist, net user, and whoami.

Explore related command guides: net share for managing network shares, taskkill for terminating processes, and sc for service management.

Check out our About page to learn more about Windows Command Simulator and our mission to make Windows command-line tools accessible to everyone.

Summary

The openfiles command is an essential Windows utility for managing files opened by network users through SMB/CIFS shares. It provides three operational modes: querying open files to identify who has what locked, disconnecting specific file handles to release locks, and enabling/disabling local file tracking for complete file handle visibility.

Key parameters include /query for displaying open files in TABLE, LIST, or CSV format, /disconnect for closing file handles by ID, username, open mode, or file path, /local for toggling local file object tracking, and /s for remote server administration. Verbose mode (/v) and no-header mode (/nh) support both human-readable and script-friendly output.

Common use cases range from resolving "file is locked" errors and cleaning up abandoned user sessions to security auditing, pre-migration cleanup, and continuous file server monitoring. System administrators rely on openfiles for managing multi-user file access conflicts across enterprise network shares.

Always warn users before disconnecting their file sessions—unsaved work will be lost. Enable local file tracking (/local on) only during active troubleshooting to avoid unnecessary performance overhead. For local process file locks not visible to openfiles, consider Sysinternals Handle.exe or Process Monitor as complementary tools.