VMware ESXi and vSphere Cluster Management

Using Handle View in Process Explorer

Learn how to use Process Explorer Handle View to inspect open files, registry keys, processes, threads, and other kernel object handles safely.

Handle View is a lower-pane mode in Process Explorer that lists the handles opened by the currently selected process. It is useful when you need to understand which operating-system resources an application or service is using.

Common investigation goals include finding an open file that prevents renaming or deletion, identifying registry locations an application is using, inspecting network-related objects, and diagnosing resource locks or unexpected resource usage.

Windows Kernel Objects and Handles

A kernel object is an operating-system-managed representation of a resource or synchronization construct. Examples include files, registry keys, processes, threads, sections, desktops, and communication-related objects.

Applications normally do not manipulate the underlying kernel object directly. Instead, Windows gives the application a handle: a process-specific numeric reference that the application uses when requesting operations on the object.

Each process has a handle table. This process-associated mapping resolves a handle value to an underlying kernel object and records access information. The same numeric handle value in two different processes does not necessarily refer to the same object.

Component	Meaning
Process	The running program whose resources are being inspected.
Handle table	The process-specific mapping between handle values, kernel objects, and access information.
Handle value	A numeric, process-local reference used by the application.
Kernel object	The Windows-managed object represented by the reference.
System resource	The underlying resource, such as a file, registry key, thread, or network endpoint.

In practical terms, Handle View shows the references held by one process. It does not mean that every listed object is suspicious or unused. A normal application can legitimately hold many handles while it runs.

Opening Handle View

Start Process Explorer with the permissions needed to inspect the target process.
Select the target process in the upper process list. The highlighted process is the selected process.
Press Ctrl+H to switch the lower pane to Handle View.
Review the entries shown in the lower pane. They belong to the currently selected process.

If you select a different process in the upper pane, the Handle View results change to show that process's handles. Always verify the selected process before interpreting an entry.

Press Ctrl+L to close or hide the lower pane.

Shortcut	Result
`Ctrl+H`	Switches the lower pane to Handle View.
`Ctrl+L`	Closes or hides the lower pane.

Reading Handle Entries

Handle View commonly emphasizes the object type and object name. The object type identifies the category of kernel object, while the name can identify the file path, registry path, desktop, communication object, or another named resource.

A named object has an identifiable name that can be displayed in the handle list. Names and types provide important context: a File entry can point to the file keeping a document locked, and a Key entry can show a registry location currently used by an application.

Some handles do not expose a useful or human-readable name. An entry may have no name, an incomplete name, or a name that only makes sense to Windows or the application. This is normal and does not by itself indicate a problem.

Interpret each entry in the context of the selected process. For example, a service may legitimately hold files, events, threads, registry keys, and synchronization objects. A handle becomes more interesting when it relates to a specific symptom, such as a file lock, unusual resource growth, or unexpected application behavior.

Common Handle View Object Types

Object type	What it commonly represents	Example investigation use
File	An open file or file-system resource.	Find the process keeping a file open so it cannot be renamed, deleted, or replaced.
Directory	An open directory or directory-related file-system object.	Investigate directory access or file-system activity.
Key	A Windows registry key.	Review registry locations currently opened by an application.
Thread	A thread object associated with a running process.	Understand process relationships and thread-related references.
Process	A reference to another process object.	Investigate process-to-process access or management activity.
Section or image-related object	A memory-mapped section or an executable image-related object.	Examine memory sharing, mapped files, or executable loading context.
Desktop	A Windows desktop object associated with an interactive session.	Inspect graphical or session-related resources.
Window Station	A Windows window-station object that groups desktops and related user-interface resources.	Investigate session and user-interface relationships.
Network endpoint	A network-related communication object, such as an endpoint used for connections.	Relate a process to network activity when the object details are available.
Synchronization and other types	Objects such as events, mutexes, semaphores, timers, and other operating-system resources.	Investigate coordination between threads or other operating-system activity.

Using the Handle Context Menu

Select a handle entry in the lower pane.
Right-click the entry to open its context menu.
Choose Properties to inspect available details about the selected handle.
Use the details to verify the object type, name, and relationship to the selected process before taking action.

Properties is an inspection action. It helps you gather evidence and understand what the handle represents. The available information depends on the object and the access permitted by Windows.

Close Handle is different. It forcibly removes the selected process's access reference to that object. This is a destructive troubleshooting action, not merely another way to view details.

Action	Purpose	Risk level	Recommended use
View handle list	Display handles held by the selected process.	Low	Use routinely for investigation.
Open Properties	Inspect available details for a selected handle.	Low	Use to verify an entry before deciding on remediation.
Close Handle	Force-close the selected handle in the process.	High	Use only during controlled, justified troubleshooting after safer options are considered.

Practical Example: Investigating a Locked File

Suppose a file cannot be renamed or deleted because Windows reports that it is in use.

Select a suspected application or service process in Process Explorer.
Press Ctrl+H to open Handle View.
Inspect File-type entries for the relevant path or filename.
Select a matching entry and choose Properties to verify the object details.
Use the finding to decide on a safe remediation. Prefer normal application exit, a supported service stop, or an appropriate process restart.

An open file handle can explain why another operation reports that the file is in use. Finding the handle does not automatically mean that it should be closed forcibly.

Practical Example: Reviewing Registry Activity

Select the application process.
Open Handle View with Ctrl+H.
Locate Key-type objects and review their names.
Use Properties when more detail is needed.
Use the observed registry locations to investigate configuration behavior or access patterns.

Registry handles can reveal which configuration areas a process is actively using. Do not close registry handles indiscriminately; the application may depend on them.

Practical Example: Inspecting Desktop Resources

Select an interactive process.
Display its handles.
Review Desktop and Window Station entries when present.
Open Properties to understand the referenced object.

Graphical and session-related processes can hold handles to desktop environment objects. Their presence is often expected for applications that interact with the Windows user interface.

Safety Considerations for Close Handle

Force-closing a handle is an advanced troubleshooting action, not a routine cleanup method. A handle may represent an operation the application still needs, even when the object name does not make that obvious.

Closing a handle can cause application instability, crashes, incomplete writes, lost work, data corruption, inconsistent application state, or unexpected service behavior. The effect depends on the object and on how the application handles the loss of its reference.

Before using Close Handle:

Confirm the process identity, executable path, user context, and selected object.
Record the process name or identifier, handle value if shown, object type, object name, and the reason for the investigation.
Determine what will likely happen if the reference disappears, especially for files being written or synchronization objects.
Try safer alternatives first: close the application normally, stop a service through its supported management method, or restart the process when appropriate.
Use forced closure only in a controlled and justified troubleshooting situation.

To decide whether to force-close a handle, confirm the exact object entry and ask whether the process can instead be closed or restarted normally. Document the expected consequence before acting.

Troubleshooting Patterns

A file remains locked

Inspect the selected process's File handles and look for the target path. Prefer a normal application exit, supported service stop, or process restart before considering forced closure.

An application retains an unexpected registry resource

Review Key handles and their names and properties. Use the evidence to investigate the application's configuration behavior rather than closing registry handles without understanding their purpose.

The wrong process appears to hold the resource

Change the selected process and compare the Handle View results. Verify the process name, executable path, user context, object type, and object details before taking action.

Closing a handle causes an application failure

Treat the failure as evidence that the handle was required. Restart the affected application or service through supported methods, and avoid repeating the forced closure outside a controlled test.

Exam-Relevant Notes

Handle View is the Process Explorer lower-pane mode for handles opened by the selected process.
A handle is a process-local numeric reference; it is not the kernel object itself.
The process handle table maps handle values to kernel objects and access information.
Changing the selected process changes the Handle View results.
Ctrl+H opens or switches to Handle View, while Ctrl+L hides or closes the lower pane.
Properties inspects a handle; Close Handle forcibly removes the reference and carries significant risk.
An open file handle may explain a file-in-use error, but identifying the handle does not justify force-closing it automatically.

For related lower-pane inspection, continue with Handle View in Process Explorer.