I need to remove WinToolBox. Its files and DLLs remain locked and access‑denied even in Safe Mode.

Process Explorer is a supported Microsoft Sysinternals tool for Windows 11, but the safer way to remove WinToolBox is to terminate the process holding its files—or schedule those files for deletion at boot—rather than forcibly closing individual handles.

Preferred option: PowerToys File Locksmith

File Locksmith is Microsoft’s GUI utility specifically for identifying processes using a file or directory. It terminates the locking process instead of manually closing one internal handle, reducing the risk of leaving that process in an inconsistent state.^1^

1. Install Microsoft PowerToys and open PowerToys Settings.
2. Select File Locksmith and enable it.
3. In File Explorer, right-click the WinToolBox installation directory.
4. Select Show more options → Unlock with File Locksmith.
5. Select Restart as administrator so it can inspect processes running under other accounts or with elevation.
6. Inspect every reported process:
   • If it is clearly a WinToolBox executable, select End task.
   • Do not terminate Windows processes such as System, services.exe, or svchost.exe merely because they appear.
7. Run WinToolBox’s uninstaller, or delete its directory after its processes have stopped.

Administrator elevation is required for File Locksmith to end elevated processes.^2^

Its command-line equivalent is also available:

# Open Windows Terminal as administrator.
PowerToys.FileLocksmith.CLI.exe "C:\Path\To\WinToolBox"

# After verifying that every reported process belongs to WinToolBox:
PowerToys.FileLocksmith.CLI.exe "C:\Path\To\WinToolBox" --kill

The --kill option terminates all processes locking the specified path, so inspect the output before using it.^1^

Process Explorer: supported, but use handle closing cautiously

The current Microsoft page lists Process Explorer v17.21 and supports Windows 11 and later. It can search for processes that have a particular file handle open or DLL loaded.^3^

To use it safely:

1. Run procexp.exe as administrator.
2. Select Find → Find Handle or DLL.
3. Search for WinToolBox or a distinctive part of its installation path.
4. Open the matching process and verify its image path and process owner.
5. Prefer terminating a confirmed WinToolBox process normally, then retry the uninstall.
6. Use Close Handle only as a last resort and only on a handle owned by a confirmed WinToolBox process.

Microsoft’s corresponding command-line Handle utility explicitly warns that forcibly closing handles can cause application or system instability.^4^ Reports of historical bugs do not establish that the current Process Explorer release is unusable, but Microsoft does not provide a complete current known-bugs list in the cited documentation.

If the file immediately becomes locked again

A WinToolBox service or startup component may be relaunching it. Since Safe Mode did not release it, use a clean boot, which provides finer control over third-party services:

1. Search for msconfig and open System Configuration.
2. On Services, select Hide all Microsoft services, then Disable all.
3. On Startup, select Open Task Manager and disable enabled startup items.
4. Restart, uninstall WinToolBox, and remove its remaining directory.
5. Return to msconfig, select Normal Startup, and re-enable the startup items you want.

Microsoft documents clean boot specifically for diagnosing background software conflicts and failed application uninstalls.^5^

If deletion still fails: schedule it for boot

Microsoft Sysinternals MoveFile can schedule deletion during the next boot, before applications reference the file. An empty destination means “delete.”^6^

movefile "C:\Path\To\WinToolBox\locked.dll" ""
movefile "C:\Path\To\WinToolBox\another.dll" ""
pendmoves
shutdown /r /t 0

Schedule only verified WinToolBox files—not shared Windows or application DLLs.

“Access denied” after no locking process is found

A lock and an NTFS permission failure are different conditions. If Process Explorer/File Locksmith reports no holder, closing handles will not fix the problem. Avoid taking ownership of Windows-managed or shared system directories merely to remove one application. If the affected files are confined to WinToolBox’s own folder, use its vendor uninstaller or obtain removal instructions from its publisher.

If WinToolBox is unwanted or potentially malicious, update Windows Security, run a Full scan, and then run Microsoft Defender Offline. Microsoft recommends the offline scan when unwanted software persists.^7^

References

1. File Locksmith utility
2. PowerToys running with administrator permissions
3. Process Explorer v17.21
4. Handle v5.0
5. [Windows 11](https://support.microsoft.com/windows/experience/startup-boot/how-to-perform-a-clean-boot-in-windows)
6. PendMoves v1.3 and MoveFile v1.02
7. Protect your PC from unwanted software | Microsoft Support