VMware ESXi and vSphere Cluster Management

Handle View Tabs in Process Explorer

Learn how the Details and Security tabs in Process Explorer handle Properties help identify Windows objects, open files, permissions, counts, and kernel resource usage.

Process Explorer can show the handles opened by a process. A handle is a value held by a process that refers to a Windows object and enables operations on that object. A Windows object is a kernel-managed resource such as a file, registry key, event, mutex, process, thread, section, or token.

Inspecting handles is useful when investigating a file that cannot be renamed, a registry key that remains in use, a synchronization object shared by applications, or security-related access. The handle connects a process to the underlying object, giving you evidence about what the process is using.

Opening a Handle's Properties

1. Start Process Explorer and select the process you want to investigate.
2. Display the lower pane and set it to the handle view.
3. Review the handles listed for the selected process.
4. Double-click a handle entry to open its Properties dialog.

The Properties dialog presents tabs for different categories of information. The two tabs covered here are Details and Security. Some process and handle information may require Process Explorer to run with elevated rights.

The Details Tab

The Details tab presents identifying and lower-level information about the selected handle and the object to which it refers. The exact fields available, and their meaning, can vary by object type and Windows version.

Object Name

The object name is the path or kernel namespace name associated with an object when the object has a name. For a file handle, it may help connect the entry to a familiar file-system path. Named events and mutexes may use an internal Windows namespace rather than a normal file path.

Some objects are unnamed, so a blank name does not mean that the handle is unimportant. Use the object type, owning process, and other details to interpret it.

Object Type

The object type identifies the category of Windows object represented by the handle. Examples include File, Key, Event, Mutex, Section, Process, and Thread. Object type is especially useful when the name is blank or uses an unfamiliar namespace.

Kernel Object Address

The kernel object address is the memory address of the underlying object in kernel memory. It is primarily a diagnostic identifier. Advanced investigations can use it to distinguish objects or correlate observations, but it is not normally a user-facing path and should not be treated as a permanent identifier.

Handle Count and Reference Count

Handle count is the number of currently open handles that refer to the object. A process can have one or more handles to the same object, and other processes may hold handles to it as well.

Reference count is the total number of kernel references keeping the object alive. It can include references that are not represented by user-mode handles. Therefore, reference count and handle count are different measurements.

Quota Charges

Some object types report quota charges for paged pool and nonpaged pool. Paged pool is kernel memory that can be paged to disk under appropriate conditions. Nonpaged pool is kernel memory that must remain resident because it may be needed at elevated interrupt levels.

These quota fields describe kernel-memory accounting associated with object creation. The charges are charged against the creating process's quota, although the exact fields and reporting behavior can vary by object type and Windows version. They are not the same as ordinary application memory consumption.

The Security Tab

Where supported, the Security tab opens the standard Windows security editor for the selected object or handle. A security editor is the Windows interface used to inspect or, when authorized, modify object permissions.

The displayed security descriptor can include the owner, groups or other principals, permissions, and individual access control entries (ACEs). An ACE is one allow or deny rule in an object's access control list. Together, these settings describe which users or processes may access the object and which rights they may request.

Inspecting an object's security descriptor is not the same as determining the effective rights currently granted to one particular process handle. The Security tab generally shows the object's security settings; it does not by itself prove every right that a specific handle already has. Existing handle access was evaluated when the handle was opened, and the process token, requested access, inheritance, privileges, and other factors can affect the result.

Changing permissions requires appropriate Windows permissions and may require administrative privileges. Inspect settings first, change them only when authorized, and record the original configuration before making a justified change.

Practical Investigation: A File That Cannot Be Renamed or Deleted

1. Locate the suspected process in Process Explorer. If you do not know the process, investigate likely applications, services, and related child processes.
2. Show the selected process's lower-pane handle list.
3. Identify an entry whose object type is File and whose object name matches, or clearly corresponds to, the affected path.
4. Double-click the entry to open Handle Properties.
5. Use the Details tab to confirm the object name and object type. This connects the locked file to the process using it.
6. Use that evidence to decide whether the application can be closed normally or whether its service can be stopped through its normal management procedure.

A file handle's object name helps connect a locked file to the process using it, but it does not by itself prove that closing the handle is safe. The application may be actively reading, writing, or coordinating access.

Practical Investigation: An Event or Mutex

1. Open Properties for a handle whose object type is Event or Mutex.
2. Review the object name, if present. A named synchronization object can reveal how components coordinate or identify a shared resource.
3. Review handle count and reference count. Multiple references can indicate that the object remains in use by several components or by the kernel.
4. Use the Security tab to inspect which accounts or principals are allowed to access the object.

Named synchronization objects can be inspected both as kernel objects and as securable resources. An unnamed event or mutex can still be important even when its name is blank.

Practical Investigation: Elevated Kernel Resource Use

1. Open Properties for an object type that reports quota information.
2. Review the paged-pool and nonpaged-pool quota charges.
3. Remember that these charges relate to object creation and are charged against the creating process's quota.
4. Compare the individual object's information with broader process and system resource data before drawing conclusions.

A single object's quota charge is diagnostic context, not a complete explanation of high memory or pool usage. Use system-wide pool counters and repeated observations when investigating a suspected resource leak.

Using Handle Information Safely

An object name and type can identify which process is holding a file or another resource open. Counts can show that an object has several handle references or remains alive because of additional kernel references. Together, these observations provide evidence before you close a handle, terminate a process, change permissions, or reboot.

Troubleshooting Missing or Unclear Information

The Expected Handle Does Not Appear

• Confirm that the correct process is selected.
• The handle may have been closed before inspection. Refresh or repeat the search while the problem is occurring.
• The resource may be held by a child process, service, or different process. Inspect related processes.
• Insufficient privileges may prevent complete inspection. Run Process Explorer with appropriate elevation when permitted.

The Object Name Is Blank or Unfamiliar

• Some object types are unnamed.
• The displayed name may use an internal Windows namespace rather than a familiar file-system path.
• Use the object type, process context, counts, and other handle details together.
• Do not assume that an unnamed object is irrelevant.

Security Information Cannot Be Changed

• The current account may lack the required permission.
• The object type may not expose editable security through the dialog.
• The object may be protected or controlled by the operating system or another component.
• Inspect without modifying unless a permission change is authorized and justified. Use an account with the required rights only when appropriate.

A User Wants to Close a Handle to Release a Locked Resource

The handle may legitimately remain open because the application is actively using the resource. First close the application normally or stop the responsible service normally. Forced closure can cause crashes, corruption, data loss, or inconsistent application state.

Exam-Relevant Notes

• A handle is a process-specific reference to a Windows kernel object.
• Object name identifies the underlying object when a name exists; object type identifies its category.
• Handle count counts open handles, while reference count includes total kernel references and can include more than user-mode handles.
• Paged-pool and nonpaged-pool quota charges relate to object creation and are charged against the creating process's quota; they are not ordinary application memory measurements.
• The Security tab exposes an object's security descriptor where supported. It does not, by itself, establish the effective rights of a particular process handle.
• Use handle properties as evidence before taking disruptive action, and avoid forced handle closure unless the risks are understood and the action is justified.