Often, I am not able to remove correctly an external disk unit connected via USB, if I try the standard way (right click over the proper icon in the taskbar, see Figure 1). Indeed, this operation frequently fails due to some process that is blocking the unit (Fig. 2).

Actually, unplugging anyway the unit should not be a problem, except in some cases (for example, data are still being written on the unit, and they might get lost or corrupted). Nevertheless, in the case of an external hard disk that keeps spinning, I would frankly prefer not to disconnect it abruptly.

So the point is how to identify the process that is preventing the removal. Well, concerning me, very often (nearly always, I would say) this is due to the process MsMpEng.exe, related to Windows Defender (as it can be seen in various topics in Microsoft websites). It took a lot of difficulties and numerous searches to understand it, and it can be checked in a relatively simple fashion via a task manager, for example Process Explorer by SysInternals. Clicking on the process MsMpEng.exe (Fig. 3) and sliding down the lower pane of handles, you can see all the disk units “engaged” by this process (Fig. 4).

Actually, in File Explorer we are used to identify the unit via its letter, and it is not trivial getting the relation between this letter and the HardDisk Volume number that is displayed, that is to understand if the disk we want to remove is present or not in the list that we see. The simplest way is to use an external utility, for example Drive Letter View by NirSoft. With this free standalone software, we can see that the unit marked by the letter H (Fig. 5), that is the disk to remove, is associated – sliding the horizontal bar – to the HardDisk Volume 14 (Fig. 6), thus confirming that MsMpEng.exe is keeping the disk occupied.

At this point, I remind you that I am not a computer scientist nor an expert in the field, thus I just report a procedure that, till now, has been safely working for me, but I advise against doing it, if you are not familiar with the proposed tools. Try it only if you know what you are doing and you are aware of the possible connected risks.

The possible solution consists in selecting in Process Explorer (or another task manager) the correctly detected disk unit (Fig. 7), clicking with the mouse right button and closing the corresponding handle (Fig. 8), confirming the task if you are aware of what you are doing (Fig. 9), otherwise do not go on. After few seconds of waiting, you can try to remove the unit as in Figure 1. If it does not succeed at the first attempt, wait few seconds more and try again.

First release: 4 April 2021 | Last update: 4 April 2021