Why do I need admin rights for Process Explorer?

Without elevation, Process Explorer can't see handles/threads for processes owned by other users or the system, and some columns show access-denied.

How do I find what's locking a file?

Use Find > Find Handle or DLL (Ctrl+F) and type the file or folder name; matching processes and their handles are listed.

Can I close a stuck handle safely?

Sometimes, but it can crash the owning process since it isn't expecting the handle to disappear. Save your work first.

How to Use Process Explorer

Download now

This walkthrough covers getting Process Explorer running and using its core panes — process tree, handles, DLLs — to investigate a running system.

Updated August 9, 2026 · PC Utility Hub Editorial Team

Getting started

1Download Process Explorer from the official Sysinternals page and extract the ZIP to a folder.
2Right-click procexp.exe (or procexp64.exe on 64-bit systems) and choose Run as administrator for full visibility into all processes.
3Accept the Sysinternals license prompt on first launch.

Reading the process tree

The main window lists processes in a tree indented by parent-child relationship. Colors are meaningful: pink/purple typically marks services, blue marks processes running under your own account, and a brief green or red flash highlights new or exiting processes.

Viewing handles and DLLs

1Click a process, then press Ctrl+H to toggle the lower pane to Handles, or Ctrl+D for DLLs.
2Use the search box (magnifying glass icon or Ctrl+F) and type a filename or partial path to find which process has it open.
3Right-click a handle and choose Close Handle to forcibly release a lock — use with caution since this can destabilize the owning process.

Checking CPU and memory details

Double-click any process to open its properties dialog, which includes tabs for Threads (with call stacks), TCP/IP connections, and environment variables. The main window's CPU column can be switched to show CPU cycles or history graphs via right-click on the column header.

Verifying signatures and reputation

1Go to Options > Verify Image Signatures to flag unsigned or altered binaries.
2Enable Options > VirusTotal.com > Check VirusTotal.com to add a column showing detection ratios for running images (this sends file hashes to VirusTotal).

VirusTotal checks require internet access and submit file hashes (not full files, unless you opt to upload) to a third-party service.

Common everyday tasks

Suspend a frozen app instead of killing it, to inspect it before ending it (right-click > Suspend).
Use Find Window's Process to drag the target icon over a hung window and jump straight to its process.
Check System Information (View > System Information) for live CPU, memory, and I/O graphs.

Frequently asked questions

Why do I need admin rights for Process Explorer?: Without elevation, Process Explorer can't see handles/threads for processes owned by other users or the system, and some columns show access-denied.
How do I find what's locking a file?: Use Find > Find Handle or DLL (Ctrl+F) and type the file or folder name; matching processes and their handles are listed.
Can I close a stuck handle safely?: Sometimes, but it can crash the owning process since it isn't expecting the handle to disappear. Save your work first.