When a program keeps a file locked or a process is using unexpected resources, Process Explorer gives you a closer look at what is active in Windows. It displays process relationships, CPU and memory use, and details about the handles and DLLs associated with a selected process.
Process Explorer shows how processes are related
The upper pane lists active processes as a hierarchy, so a parent process and the programs it started appear together. Names of the accounts that own each process are shown in the list. This view can clarify which application launched a process when its name alone does not explain what it does.
Process Explorer also displays CPU and memory use. Select a process in the upper pane to examine it further; the lower pane then shows details for that selection.
The lower pane reveals handles and loaded files
Choose handle mode to see the handles opened by the selected process. These references include items such as files and other Windows objects, and can help identify which process has a particular file open.
DLL mode displays the DLLs and memory-mapped files loaded by that process. This view can help trace a loaded component when investigating a DLL version issue or figuring out which software has a file in use.
- Use the handle view to investigate open resources.
- Switch to DLL mode to inspect loaded libraries and memory-mapped files.
Search locates processes using a handle or DLL
Process Explorer’s search can find processes that have a specified handle open or a particular DLL loaded. Enter the item you are tracking to locate matching processes, then select a result to inspect it in the process list and lower pane.
Pros
- Shows active processes in a parent-and-child tree
- Displays owning accounts beside process names
- Searches for processes using specific handles or DLLs
- Switches the lower pane between handle and DLL views
System requirements: Windows 11
How can Process Explorer identify which process has a file open?
Search for the file or handle. Process Explorer can show matching processes, and handle mode displays the selected process’s open handles.
What does DLL mode show?
It lists every library and mapped file the selected process has loaded.
Where can I see which account owns a process?
The owning account appears beside the process name in the upper pane.