Windows openfiles Command Syntax and Examples

The openfiles command helps Windows administrators query and disconnect files opened over shared resources. It is especially useful in file-lock incidents where users cannot rename, move, or delete files because another session holds a handle.

This guide explains core syntax, local tracking prerequisites, and practical commands for safe operations.

What Is `openfiles`?

openfiles reports open file objects and can disconnect sessions in supported scenarios. It is a classic admin tool for SMB-related lock diagnostics.

Syntax

openfiles /query [/s system [/u user [/p password]]] [/fo {TABLE|LIST|CSV}] [/nh] [/v]
openfiles /disconnect [/s system [/u user [/p password]]] /id id [/a accessedby] [/op openmode]
openfiles /local {on|off}

Switch	Meaning
`/query`	list open files
`/disconnect`	disconnect an open file session
`/id`	target by open file ID
`/local on`	enable local open file tracking
`/fo`	output format control

Parameters / Options

`/query`

Use for discovery before any disconnect action.

`/disconnect`

Use with caution; can interrupt active user operations.

`/local on`

Enables local tracking and often requires reboot to fully apply.

Examples

1. Query open files

openfiles /query

2. Verbose list output

openfiles /query /fo list /v

3. CSV export for ticket

openfiles /query /fo csv > C:\Temp\openfiles.csv

4. Enable local tracking

openfiles /local on

5. Disconnect a specific ID

openfiles /disconnect /id 248

6. Remote query

openfiles /query /s FILESERVER01 /u DOMAIN\Admin /p *

Common Use Cases

Resolving shared-folder lock incidents.
Identifying active sessions blocking file maintenance.
Producing evidence before user-impacting disconnect actions.
Auditing SMB usage in support windows.
Remote diagnostics on file servers.

Tips and Best Practices

Always run /query before /disconnect.
Notify users before disconnecting active sessions.
Prefer ID-targeted disconnect over broad actions.
Use CSV exports for escalation documentation.
Enable /local on proactively on systems that need local lock diagnostics.

Troubleshooting Common Issues

"INFO: The system global flag ..."

Local tracking is disabled; run openfiles /local on and reboot if needed.

Access denied

Run elevated and verify admin rights on target host.

No results but lock exists

Lock may be local process handle; inspect with additional tools/process checks.

Disconnect does not resolve issue

Another process reopened the file; verify continuously.

Related Commands

`net file`

Alternative SMB file session view in some environments.

`tasklist`

Process context during local lock investigation.

`taskkill`

Terminate locking process if approved.

`icacls`

Confirm issue is lock-related, not ACL denial.

Frequently Asked Questions

Does `openfiles` work without `/local on`?

Remote/shared scenarios work, but local tracking may require /local on.

Is reboot needed after `/local on`?

Often yes, depending on system state.

Can I disconnect by username?

You can combine filters, but ID-based targeting is safer.

Is `/disconnect` risky?

Yes, it can interrupt user activity; use change control.

Which output format is best for automation?

CSV is usually best.

Can I query remote servers?

Yes, with /s and appropriate credentials.

Why no entries appear?

No tracked open files in current context, or tracking is disabled.

Is this command still useful today?

Yes, especially for SMB/file-lock support workflows.

Quick Reference Card

Command	Purpose
`openfiles /query`	list open files
`openfiles /query /fo csv`	machine-readable report
`openfiles /local on`	enable local tracking
`openfiles /disconnect /id <id>`	disconnect session

Summary

openfiles remains a practical Windows admin command for lock diagnostics and controlled session disconnects. Use discovery-first workflows, export evidence, and apply disconnect actions carefully to avoid unnecessary user impact.

What Is openfiles?