How to display really all activities on a specific drive? - Windows 10 Help Forums (2025)

This thread involves in fact 2 matters regarding activities on a specific drive, in this case an external USB drive.

1. After "File>Exiting"all applications, I'd like to dismount/remove/eject these drives. R-click taskbar button and eject.
This regularly doesn't work, error that the drive is in use.
When checkingResource Monitor I see a number of "SearchProtocol.exe"-instances. Not sure what this is.
FWIW I have unchecked the option "Allow files on this drive to have contents indexed in addition to file properties" on all drives.
Q: What is SearchProtocol.exe doing? Can I disable it, or is it a 'must'?
Problem is, I need to wait for minutes before I can 'remove' the drive.

2. As for Resource Monitor, when selecting the [Disk]-tab it will show Disk Activities on the drives.
OTOH, selecting the [CPU] tab and entering a drive in the Associated Handles box, it may (in my case) show the file manager that I use, being Opus.exe, but Opus.exe is not listed under Disk Activities.
Example: Opus.exe under 'Associated Handles' show it is active on a some drive, but Opus.exe is not listed under [Disk Activities].

Q: How to -all- activities to be displayed? (if at all possible)

Thanks.

Hi, you can disable indexing of external drives. You should be able to deselect the drive letter when shown here:

and you can disable indexing of external drives (Home & Pro) using this:
Disable Adding Removable Drives to Index and Libraries in Windows 10

As for safely removing them - I find
USB Safely Remove
very useful - when there are some 'system' processes still active but insignificant, it presents a dialogue listing those and a 'Forcibly Remove' option.

There are the more general programs for 'unlocking' files and disks locked by certain processes too.

Also see:
Create Safely Remove Hardware shortcut in Windows 10

and of course there's the 'policy' for quick removal:
Enable or Disable Disk Write Caching in Windows 10

What is SearchProtocol.exe doing? Can I disable it, or is it a 'must'?

Searchprotocol.exe is a Windows system file and should not be hacked/removed... there should be no need if you disable indexing of external drives.
Is SearchProtocolHost.exe safe? How to remove a SearchProtocolHost error?

How can you display really all activities on a specific drive?

- you can use Procmon (free from MS) and apply a suitable filter. Not very convenient though.

- you can order the list of processes given by Resource Monitor

I find the easiest and quickest method is to use the free Lockhunter utility.

Just

right-click on the drive you're interested in and choose What's locking this folder from the context menu.

Lockhunter will open a window showing any processes involved in file activity on the drive, together with an icon in the toolbar to close the locking process(es).

Hope this helps...

Hello @tfwul,

A Portable LockHunter version is available [ I use it ] >

LockHunter Portable from the download section.

@dalchina @RickC
MANY thanks indeed! Truly appreciated. Sorry for responding with some delay.

I ENabled the "Do not allow locations on removable drives to be added to libraries"
then went on with the "Create Safely Remove Hardware shortcut in Windows 10" thing
and lastly downloaded the portable lockhunter tool as suggested by Rick.

The "Safely Remove Hardware"-shortcut, well, it did not remove anything.
Tried a number of times.
Each time : "The WD blah-blah USB Device' device is not removable
and cannot be ejected or unplugged."

Then I tried the usual r-click remove button on the taskbar, that went fine.

Note: after applying the "Do not allow locations on removable..." and before removing them I noticed that Searchprotocol.exe kept on running on the external drives, so waited until it disappeared (resource monitor). By then only I could safely remove the drives.
Likely I need to reboot to make Local Group Policy Editor change applicable(?)

I assume Windows is now rebuilding the index(?), because after removal of the external drives the HDD Led blinking non stop.

I assume Windows is now rebuilding the index(?), because after removal of the external drives the HDD Led blinking non stop.

When indexed locations are removed, that does not normally result in the index being rebuilt- the indexed items are simply removed.

You can check the state of indexing by looking at Indexing Options.

There you can also see I've deselected an external drive.

As above, you can inspect the processes using your drive.

Just curious, if Eject or Safely remove doesn't work and not wanting to reboot, would it work to use Task Manager and Restart of File Explorer?

@dalchina,
Ah... super, many thanks again!
I didn't look there (Indexing Options>Indexing locations).
External drives are unchecked, so that's okay then.
Same time I noticed and can clean up some old folders as they do not exist anymore.

Berton said:

Just curious, if Eject or Safely remove doesn't work and not wanting to reboot, would it work to use Task Manager and Restart of File Explorer?

Frankly, I am not sure about that.

In my case it mostly involves 2 applications that keep on running some process one way or the other, even after a File > Exit.
This Lockhunter-tool nicely shows that,

The boring thing is that it takes a while before they are actually gone and the external drive can be removed.