Windows Event Viewer contains a lock on my exe file

Question

Something is interesting to me. I am developing a Windows service and logging all diagnostic events in the Windows event log. Therefore, when the service is running, I open the event viewer (from administrative tools) to view the results of my service operation.

This works fine except when I need to remove my program (again, for testing purposes.) For some strange reason, the event viewer stores a lock of the .exe image file for my service, so the uninstaller cannot remove it from Error ERROR_SHARING_VIOLATION :

 The process cannot access the file because it is being used by another process. 

This only happens in Vista and later, and does not seem to be a problem in XP.

Any idea how to get Event Viewer to release a file lock? (I ask about a programmatic approach. I can obviously close it manually, but that’s not what I need.)

Answer 1

Vista introduced a lesser-known feature called Restart Manager, which can help you release file locks with user-mode code. Since you marked it as C ++, based on this article, here is a small code example:

 #include <RestartManager.h> #pragma comment(lib ,"Rstrtmgr.lib") BOOL ReleaseFileLock(LPCTSTR pFilePath) { BOOL bResult = FALSE; DWORD dwSession; WCHAR szSessionKey[CCH_RM_SESSION_KEY+1] = { 0 }; DWORD dwError = RmStartSession(&dwSession, 0, szSessionKey); if (dwError == ERROR_SUCCESS) { dwError = RmRegisterResources(dwSession, 1, &pFilePath, 0, NULL, 0, NULL); if (dwError == ERROR_SUCCESS) { UINT nProcInfoNeeded = 0; UINT nProcInfo = 0; RM_PROCESS_INFO rgpi[1]; DWORD dwReason; dwError = RmGetList(dwSession, &nProcInfoNeeded, &nProcInfo, rgpi, &dwReason); if (dwError == ERROR_SUCCESS || dwError == ERROR_MORE_DATA) { if(nProcInfoNeeded > 0) { //If current process does not have enough privileges to close one of //the "offending" processes, you'll get ERROR_FAIL_NOACTION_REBOOT dwError = RmShutdown(dwSession, RmForceShutdown, NULL); if (dwError == ERROR_SUCCESS) { bResult = TRUE; } } else bResult = TRUE; } } } RmEndSession(dwSession); SetLastError(dwError); return bResult; } 

Answer 2

I just met the same problem. The DLL was blocked by the svchost.exe process (Windows Audio, DHCP client, Windows event log, NetBIOS TCP / IP assistant, security center, task scheduler)

Solution: close Event Viewer! :)