Files on File Server locked by "another user" when user opened

Welcome to Microsoft Q&A!

Thank you for taking the time to provide the detailed information and screenshot.

Based on the behavior you described, Excel is detecting the workbook as already open for editing. For a file stored on an SMB share, this can occur when an open file handle or an Office lock remains associated with the document.

Since restarting SMS Agent Host (CcmExec.exe) temporarily releases the file, there appears to be a relationship with activity on the affected client. However, this behavior alone is not sufficient to confirm that Microsoft Defender Antivirus is responsible for holding the file.

SMS Agent Host is the Configuration Manager client service. Microsoft also documents specific antivirus exclusions for Configuration Manager client components, including CcmExec.exe. These recommendations are specific to Configuration Manager and should not be considered confirmation that Defender is causing this particular file-locking behavior.

I would like to share with you some recommended troubleshooting that may help you.

Before restarting SMS Agent Host or the Windows 11 computer the next time the problem occurs, I recommend identifying which process actually owns the handle to the affected file:

1. Run Microsoft Sysinternals Process Explorer as administrator.
2. Select Find > Find Handle or DLL.
3. Search for the affected file name, for example Shoes ST Report SS26 - Oct WK4.xlsx.
4. Check which process is shown as holding the file handle.

At the same time, ask the file-server administrator to check Computer Management > System Tools > Shared Folders > Open Files for the affected workbook. This can help determine whether an SMB file handle remains open and identify the associated client/session.

I would not recommend disabling Microsoft Defender Antivirus or adding a broad exclusion for the shared folder based only on the current symptoms. Antivirus exclusions reduce security inspection and should be considered only after the process responsible for the lock has been identified and the exclusion has been confirmed as appropriate for the environment.

The most important validation is therefore to capture the file-handle owner while the issue is occurring, before restarting SMS Agent Host or Windows.

• If CcmExec.exe owns the handle, the Configuration Manager client configuration and logs should be investigated and the documented Configuration Manager antivirus exclusions should be verified.
• If Defender-related activity is identified instead, Defender diagnostic/performance information should be collected during reproduction and reviewed before changing the Defender policy.

I understand that you may be looking for a definitive explanation of why the file handle is not being released. Unfortunately, further investigation would require access to diagnostic data from the affected Windows 11 clients, SMB/file-server sessions, Configuration Manager, and potentially Microsoft Defender telemetry. Microsoft Q&A is a public community forum and does not have access to this environment or the diagnostic tools required to perform that level of investigation.

Therefore, I am afraid I cannot reliably confirm the underlying product-level cause further through the forum without risking providing an inaccurate conclusion.

If you would like Microsoft to investigate the behavior further, especially because it is reproducible across multiple devices, please open a Microsoft support ticket so the appropriate support team can securely collect and analyze the required logs and traces.

If you believe the behavior was introduced by a Windows or Microsoft product change and would like to report it directly to the product team, you can submit the issue through Feedback Hub, including the reproduction steps and diagnostic data.

Thank you for your understanding. I hope the steps above help you identify which process is retaining the file handle and provide the information needed for the next level of investigation.

References:

Client health checks - Configuration Manager | Microsoft Learn

Recommended antivirus exclusions for Configuration Manager - Configuration Manager | Microsoft Learn

Process Explorer - Sysinternals | Microsoft Learn

Performance analyzer for Microsoft Defender Antivirus - Microsoft Defender for Endpoint | Microsoft Learn

If you find it useful, please click Accept Answer.

Thank you for choosing Microsoft Q&A.

PC client is Win11 .