When Windows says a USB drive is “currently in use,” some program still has a file or folder on that drive open. The fastest way to find out which one is to check Event Viewer for Kernel-PnP event 225, which names the process that stopped the ejection, or to point LockGhost at the file or folder you were working with, so it shows the process holding it by friendly name. Close or end that process, then eject again.
Pulling the drive out anyway risks losing data, especially if the drive uses the Better performance setting.
See which app is holding a file on your drive, by name, before you pull it out.
Get it from Microsoft
Why does Windows block the eject?
Safely Remove Hardware exists so cached writes can finish. Microsoft’s removal policy documentation explains that “the Safely Remove Hardware process protects the integrity of data on the device by making sure that all cached operations finish.” If a program still has a handle open on the drive, Windows will not let it go.
Common blockers:
| Blocker | Why it holds the drive |
|---|---|
| An open document | Word, Excel, or a PDF viewer still has a file open |
| File Explorer | A window or preview is showing the drive’s contents |
| A terminal | Command Prompt or PowerShell has its current folder on the drive |
| Antivirus | A scan of the newly connected drive is running |
| Search indexing or sync | An indexer or sync app is reading files |
| A media player or editor | A project or playlist references files on the drive |
| System, PID 4 | A kernel-level component has the volume open |
Do I even need to eject?
It depends on the drive’s removal policy. Per Microsoft, “beginning in Windows 10 version 1809, the default policy is Quick removal,” which “keeps the device ready to remove at any time,” and “you can remove the device without using the Safely Remove Hardware process.”
| Policy | Default? | Must you eject? |
|---|---|---|
| Quick removal | Yes, since Windows 10 version 1809 | No, but make sure nothing is still writing |
| Better performance | No, you must choose it | Yes, Microsoft says you “must use the Safely Remove Hardware process” |
Even with Quick removal, pulling a drive while a program is mid-save can damage that file. The in-use warning is still worth resolving.
How do I check or change a drive’s removal policy?
Microsoft documents the steps:
- Connect the drive and note its drive letter in File Explorer.
- Right-click Start and choose Disk Management.
- Right-click the drive’s label in the lower section and choose Properties.
- Open the Policies tab. If you do not see it, open the Hardware tab, select the removable drive, choose Properties, and the Policies tab should be there.
- Choose Quick removal or Better performance.
If you choose Better performance, Microsoft recommends also enabling write caching on the device, and you must then eject every time. For a drive you move between computers often, Quick removal is the safer habit.
How do I find what is using the drive with Event Viewer?
Windows logs the blocker when an eject fails.
- Try to eject the drive so the failure is logged.
- Open Event Viewer by right-clicking Start and choosing Event Viewer.
- Go to Windows Logs, then System.
- Choose Filter Current Log and enter
225as the event ID. - Read the newest event from Kernel-PnP. It reads like “The application … with process id … stopped the removal or ejection for the device,” as in this Microsoft Q&A example.
- Close that app normally, then eject again.
If the event names System with process ID 4, you cannot end it. Wait a minute for scans and indexing to finish, close File Explorer windows on the drive, or sign out or shut down before unplugging.
How do I find the blocker with LockGhost?
Event 225 names the process but not the file. If you know which file or folder on the drive you were using, LockGhost shows every process holding that path.
- Install LockGhost from the Microsoft Store.
- Right-click the file or folder on the USB drive in File Explorer, or paste its path into LockGhost.
- Read the friendly name and severity color for each process holding it.
- Close the app normally if you can. If not, use LockGhost’s guarded End Process, which “confirms before you end a process and hard-blocks critical system roles,” per the LockGhost product page.
- Eject the drive again.
LockGhost is built on the Windows Restart Manager API. It reports locks on the paths you give it. For a drive-level handle held by System, Event Viewer is the better first stop.
Friendly names and severity colors instead of PIDs, fully offline.
Get it from Microsoft
What else can I try?
| Try this | When |
|---|---|
| Close all File Explorer windows showing the drive | Always, as the first step |
cd out of the drive in any open terminal | You used Command Prompt or PowerShell on it |
| Wait a minute | The drive was just plugged in and a scan may be running |
| Eject from Settings, Bluetooth & devices, Devices | The tray icon is missing |
| Sign out or shut down | Nothing else works and the blocker is System |
Microsoft’s Safely remove hardware guide covers both the tray icon and the Settings route, including how to turn the Safely Remove Hardware and Eject Media icon back on in Taskbar settings, under Other system tray icons.
Which method should I use first?
| Situation | Start with |
|---|---|
| You have no idea what is holding the drive | Event Viewer, event 225 |
| Event 225 names an app you recognize | Close that app normally |
| You know which file you had open | LockGhost on that file or folder |
| Event 225 names System, PID 4 | Wait, close Explorer windows, or shut down |
Common mistakes
- Ending File Explorer from Task Manager. It closes every Explorer window and the taskbar. Closing the windows on the drive is enough.
- Ending the antivirus. Let the scan finish instead.
- Unplugging during a copy. Wait for the copy dialog to finish.
- Assuming the drive is broken. The warning almost always means an open handle, not a hardware fault.
Frequently asked questions
What does event ID 225 mean?
It is a Kernel-PnP event logged when an application stops the removal or ejection of a device. The message names the process and its ID.
Is it safe to unplug a USB drive without ejecting?
With the default Quick removal policy, Microsoft says you can remove the device without Safely Remove Hardware. Make sure nothing is still saving to it first.
Why does the drive say in use when I have nothing open?
A background scan, indexer, sync app, or an Explorer window or preview may be reading it. Check event 225 to find out which.
Can LockGhost unlock a whole drive?
LockGhost reports what is holding the files or folders you point it at. For handles on the drive itself, use Event Viewer. See also find a handle holding a file without Process Explorer and cannot delete a file in use.
Try LockGhost
Get LockGhost from the Microsoft Store or read the LockGhost overview.
Find what is holding your files and finish the eject without guessing.
Get it from Microsoft
Microsoft and Windows are trademarks of the Microsoft group of companies. Other product names are trademarks of their owners. LockGhost is not affiliated with or endorsed by any of them.
Last updated 17 October 2026. Published by Automata Labs, a software company in Canada.