title: Windows - Can not force close network file handle - Can not close system (Pid 4) file handles
body: <p>Firstly, sorry for the long question, but I wanted to provide sufficient detail.</p>
  
  <h1>Synopsis:</h1>
  
  <p>In Windows does not appear to be possible to force close a file handle opened over a network share. Hence a file that is opened over a network share can not be moved/renamed/deleted. I am using Win 7.</p>
  
  <h1>Question:</h1>
  
  <p>Can anyone see what I am doing wrong or can someone confirm that this is as expected and it is not possible to force close system file handles (always on pid 4, such as those related to network share access to the file).</p>
  
  <h1>Background:</h1>
  
  <p>We have remote network client users who access a log file. We need to roll the log file so it does not grow too large. We can not roll the log file as the file is reported as in use.</p>
  
  <h1>Recreate Issue:</h1>
  
  <h2>0)</h2>
  
  <p>Do everything as Administrator</p>
  
  <h2>1)</h2>
  
  <p>Create a new dir and share it</p>
  
  <h2>2)</h2>
  
  <p>Create a file in the new dir</p>
  
  <h2>3)</h2>
  
  <p>Via the file share edit the file with something that tends to get a file lock like MS Word. So do Start / Run then type in \YourHostName then select the file share you creaeted, then navigate to the file and edit it with Word. This is to simulate a remote user/host locking the file.</p>
  
  <h2>4)</h2>
  
  <p>List the open file handles, we can see 2 below</p>
  
  <p>C:>handle C:\Log\MyLockedFile.txt</p>
  
  <p>Handle v3.46
  Copyright (C) 1997-2011 Mark Russinovich
  Sysinternals - www.sysinternals.com</p>
  
  <p>System             pid: 4      type: File          3E64: C:\Log\MyLockedFile.txt
  System             pid: 4      type: File          5E48: C:\Log\MyLockedFile.txt</p>
  
  <h2>5)</h2>
  
  <p>Try to close a file handle, here we see the attempt to close fail.</p>
  
  <p>C:>handle -c 3E64 -p 4</p>
  
  <p>Handle v3.46
  Copyright (C) 1997-2011 Mark Russinovich
  Sysinternals - www.sysinternals.com</p>
  
  <p>3E64: File  (R--)   C:\Log\MyLockedFile.txt
  Close handle 3E64 in System (PID 4)? (y/n) y
  Error closing handle:
  The handle is invalid.</p>
  
  <h2>6)</h2>
  
  <p>List network file handles, here we see the opened network shares to the file.</p>
  
  <p>C:>openfiles /query -v</p>
  
  <p>INFO: The system global flag 'maintain objects list' needs
        to be enabled to see local opened files.
        See Openfiles /? for more information.</p>
  
  <p>Files opened remotely via local share points:</p>
  
  <p>Hostname        ID       Accessed By          Type       #Locks     Open Mode       Open File (Path\executable)
  14693W7N        67109233 myuser1              Windows    0          Write + Read    C:\Log\MyLockedFile.txt
  14693W7N        495      myuser1              Windows    0          Read            C:\Log\</p>
  
  <h2>7)</h2>
  
  <p>Close/disconnect file handles to the file, here it appears to work</p>
  
  <p>C:>openfiles /disconnect /a * /OP C:\Log\MyLockedFile.txt</p>
  
  <p>SUCCESS: The connection to the open file "C:\Log\MyLockedFile.txt" has been terminated.</p>
  
  <h2>8)</h2>
  
  <p>System file handle is still active even after attempting to delete it.</p>
  
  <p>C:>handle C:\Log\MyLockedFile.txt</p>
  
  <p>Handle v3.46
  Copyright (C) 1997-2011 Mark Russinovich
  Sysinternals - www.sysinternals.com</p>
  
  <p>System             pid: 4      type: File          3E64: C:\Log\MyLockedFile.txt</p>
  
  <h2>9)</h2>
  
  <p>The file can not be moved/renamed as it is still in use</p>
  
  <p>C:>move C:\Log\MyLockedFile.txt C:\Log\MyLockedFile.txt.newName
  The process cannot access the file because it is being used by another process.
          0 file(s) moved.</p>