Dos - Openfiles Command

About

The open files command enables an administrator to list or disconnect files and folders that have been opened on a system.

See File System - Open File

More info:

Openfiles.exe /?

Configuration

openfiles /local on
SUCCESS: The system global flag 'maintain objects list' is enabled.
         This will take effect after the system is restarted.

Example

openfiles | more
Files Opened Locally:
---------------------

ID    Process Name         Open File (Path\executable)
===== ==================== ==================================================
12    taskhost.exe         C:\Windows\System32
252   taskhost.exe         C:\Windows\Registration\R000000000005.clb
440   taskhost.exe         C:\Windows\System32\en-US\KernelBase.dll.mui
572   taskhost.exe         C:\Windows\System32\en-US\msutb.dll.mui
692   taskhost.exe         C:\Windows\System32
12    dwm.exe              C:\Windows\System32
12    explorer.exe         C:\Windows\System32
16    explorer.exe         C:\..4ccf1df_1.1.7601.18120_none_2b25b14c71ebf230
240   explorer.exe         C:\ProgramData\Microsoft\Windows\WER\ReportArchive
328   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
380   explorer.exe         C:\Windows\Registration\R000000000005.clb
388   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
392   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
428   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
452   explorer.exe         C:\..1e18e3b_9.0.30729.6161_none_08e61857a83bc251
456   explorer.exe         C:\..1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895
476   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
504   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
568   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
600   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
660   explorer.exe         C:\Windows\Fonts\StaticCache.dat
668   explorer.exe         C:\..ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3
672   explorer.exe         C:\..\comctl32.dll.mui
796   explorer.exe         C:\Users\gerard\Desktop
804   explorer.exe         C:\Users\Public\Desktop
812   explorer.exe         C:\..\gerard\AppData\Local\Microsoft\Windows\Burn
820   explorer.exe         C:\..\gerard\AppData\Local\Microsoft\Windows\Burn
828   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
860   explorer.exe         C:\..\Local\Microsoft\Windows\WER\ReportArchive
908   explorer.exe         C:\Users\Public\Desktop
944   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
960   explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
976   explorer.exe         C:\Windows\System32\en-US\prnfldr.dll.mui
1048  explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
1072  explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
1104  explorer.exe         C:\Windows\System32\en-US\gameux.dll.mui
1164  explorer.exe         C:\Windows\System32\en-US\ActionCenter.dll.mui
1184  explorer.exe         C:\..\Internet Explorer\Quick Launch\User Pinned
1236  explorer.exe         C:\..\Content.IE5\index.dat
1248  explorer.exe         C:\..\Roaming\Microsoft\Windows\Cookies\index.dat
1260  explorer.exe         C:\..\Windows\History\History.IE5\index.dat
1432  explorer.exe         C:\..\AppData\Local\Microsoft\Windows\WER\ERC
1452  explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
1536  explorer.exe         C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
1556  explorer.exe         C:\..\Roaming\Microsoft\Windows\Network Shortcuts
1596  explorer.exe         C:\..\Roaming\Microsoft\Windows\Network Shortcuts

...................................
...................................
...................................
...................................

Files opened remotely via local share points:
---------------------------------------------

INFO: No shared open files found.

Powered by ComboStrap