(This question is not a duplicate of Find out which process is locking a file or folder in Windows I am asking specifically about when PID-4 is locking it (besides the fact that i'm saying without using guesswork. And that question doesn't even mention PID-4))
When System PID 4 is locking a file or folder, How can I determine what program/process/service is locking it without guesswork?
For example , see this result from process explorer showing a file that may be locked.
Now, without any guesswork, how can I determine what is locking it? (When the only info I see from process explorer is that it's SYSTEM/PID-4)
Added
Somebody asked if it is a duplicate of Process Explorer: How to find out what System PID 4 is The questoin is similar.. but there's no answer there that answered my case.. Also, the question there iis very simplistic and says "How could I find out which application "System, PID: 4" really is?"
I know that PID 4 isn't an application. It is something system related.. and may be a service.
So my question is not the same as that one. That one has misunderstandings about what PID 4 is and somebody could partly answer that question by just saying what it is and is not.
Best Answer
It's the Windows Kernel. This virtual process contains all running kernel-mode drivers. This also includes Windows File Sharing, HTTP.SYS and probably all virus scanners.
Unfortunately, file handle accounting is only done at process level, so you won't be able to get additional information.
(source) (also flagging as duplicate)