About
The open files command enables an administrator to list or disconnect files and folders that have been opened on a system.
More info:
Openfiles.exe /?
Articles Related
Configuration
openfiles /local on
SUCCESS: The system global flag 'maintain objects list' is enabled.
This will take effect after the system is restarted.
Example
openfiles | more
Files Opened Locally:
---------------------
ID Process Name Open File (Path\executable)
===== ==================== ==================================================
12 taskhost.exe C:\Windows\System32
252 taskhost.exe C:\Windows\Registration\R000000000005.clb
440 taskhost.exe C:\Windows\System32\en-US\KernelBase.dll.mui
572 taskhost.exe C:\Windows\System32\en-US\msutb.dll.mui
692 taskhost.exe C:\Windows\System32
12 dwm.exe C:\Windows\System32
12 explorer.exe C:\Windows\System32
16 explorer.exe C:\..4ccf1df_1.1.7601.18120_none_2b25b14c71ebf230
240 explorer.exe C:\ProgramData\Microsoft\Windows\WER\ReportArchive
328 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
380 explorer.exe C:\Windows\Registration\R000000000005.clb
388 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
392 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
428 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
452 explorer.exe C:\..1e18e3b_9.0.30729.6161_none_08e61857a83bc251
456 explorer.exe C:\..1e18e3b_9.0.30729.6161_none_0a1fd3a3a768b895
476 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
504 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
568 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
600 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
660 explorer.exe C:\Windows\Fonts\StaticCache.dat
668 explorer.exe C:\..ccf1df_6.0.7600.16385_en-us_106f9be843a9b4e3
672 explorer.exe C:\..\comctl32.dll.mui
796 explorer.exe C:\Users\gerard\Desktop
804 explorer.exe C:\Users\Public\Desktop
812 explorer.exe C:\..\gerard\AppData\Local\Microsoft\Windows\Burn
820 explorer.exe C:\..\gerard\AppData\Local\Microsoft\Windows\Burn
828 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
860 explorer.exe C:\..\Local\Microsoft\Windows\WER\ReportArchive
908 explorer.exe C:\Users\Public\Desktop
944 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
960 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
976 explorer.exe C:\Windows\System32\en-US\prnfldr.dll.mui
1048 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
1072 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
1104 explorer.exe C:\Windows\System32\en-US\gameux.dll.mui
1164 explorer.exe C:\Windows\System32\en-US\ActionCenter.dll.mui
1184 explorer.exe C:\..\Internet Explorer\Quick Launch\User Pinned
1236 explorer.exe C:\..\Content.IE5\index.dat
1248 explorer.exe C:\..\Roaming\Microsoft\Windows\Cookies\index.dat
1260 explorer.exe C:\..\Windows\History\History.IE5\index.dat
1432 explorer.exe C:\..\AppData\Local\Microsoft\Windows\WER\ERC
1452 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
1536 explorer.exe C:\..4ccf1df_6.0.7601.17514_none_fa396087175ac9ac
1556 explorer.exe C:\..\Roaming\Microsoft\Windows\Network Shortcuts
1596 explorer.exe C:\..\Roaming\Microsoft\Windows\Network Shortcuts
...................................
...................................
...................................
...................................
Files opened remotely via local share points:
---------------------------------------------
INFO: No shared open files found.