Which program is stopping you from ejecting your drive?

Windows refuses a “safely remove” when an application still holds the drive open — and it writes down exactly which application it was. Eject Doctor reads that record, names the culprit, and can ask it to close and then retry the eject.

Unzip it anywhere, run Install-EjectDoctor.ps1 once for a desktop shortcut, and double-click. Nothing to install beyond that, no admin rights, no licence key, no trial clock, no telemetry.

The window

The status card is colour-coded: green = nothing has ever blocked this drive, red = something is blocking it right now, amber = it was blocked, but that app is no longer running. There is a console mode too, for scripts and headless machines.

Why it can actually name the program

• It reads Windows’ own accusation. When an eject is refused, the PnP manager writes Kernel-PnP event 225 to the System log, naming the application, its process id, its command line and the device instance that was vetoed. The app reads the structured event data rather than the English message text, so it keeps working on a non-English Windows.
• It identifies drives by device, not by drive letter. Letters get recycled every time you swap a disk. The app matches the USB serial token that appears both in the drive’s storage path and in the veto record — so an old record for a different disk that once sat on D: is never blamed on whatever is plugged into D: today.
• It ejects the way the tray does. The eject uses CM_Request_Device_Eject. This matters, because external drives often present themselves to Windows as Fixed disks, and for those Explorer offers no right-click Eject at all.
• It closes the blocker gracefully only. Close blocker & eject sends WM_CLOSE to the app’s window and waits. It never force-kills: killing a vault or a database mid-write is how you damage the thing you were trying to protect. If the app asks you to confirm, confirm it and the eject retries.

The record

• All 25 self-test checks pass. They run with no side effects — powershell -File .\EjectDoctor.ps1 -SelfTest — and several of them fail on purpose if the logic regresses.
• The diagnosis path is verified end to end on a real machine. On the machine it was written on, it found the external disk, read ten recorded vetoes for it, and named Cryptomator.exe, including its process id and the command line holding the vault open — matched by USB serial.
• The negative checks are the important ones. A veto for a different disk on the same drive letter must not match, and no historical record may be attributed to the current drive on a letter coincidence alone. A tool that blames the wrong program is worse than one that says nothing.
• The decision that the drive has gone is checked in isolation. A live end-to-end eject unmounts whatever drive is attached, so the first real eject is yours to choose — run it on a drive you are happy to unmount. The module that decides the device has left is checked separately.

How it is meant to be used

• Not a drive-repair tool and not a data-recovery tool. It names who is holding a drive and asks them to let go; it does not touch the disk.
• Not a background service and not a driver. It does nothing until you open it, and it has no network code.
• It only offers drives that have a drive letter. A USB disk mounted without one still has to be ejected from the tray.
• It cannot report a block Windows never recorded: the record exists only because an eject was actually refused. Press Attempt eject to produce a fresh verdict.
• A USB identity that cannot be read falls back to the drive letter, and those weaker matches are labelled drive-letter in the text report.