6

In my environment, a TTF file(font file) is being held by system.exe process.
I can't understand why it's happening.
I've tried to unregister(uninstall) the font and still the system process is holding it.
My problem is when when i update the package with th ttf file, it requires system restart since the file is replaced while being held.
Does anyone have any suggestion why it is being used by system process and what can be done?
Thanks

liorafar
  • 2,264
  • 4
  • 19
  • 39
  • I didn't know Windows was able to held font files... –  Dec 28 '14 at 14:26
  • BTW, how can the system be still holding a file which doesn't even exist? (If you delete it) –  Dec 28 '14 at 14:26
  • I never said anything about deleting the file. and the file does exist. – liorafar Dec 28 '14 at 14:29
  • Well, you said *uninstall* and I suppose, when you uninstall the font, it is removed from the directory. I guess I am wrong then –  Dec 28 '14 at 14:29
  • It is not removed from directory but from windows font collection – liorafar Dec 28 '14 at 15:19

1 Answers1

7

This behaviour was introduced with a security update released in August 2014 (refer to security bulletin MS14-045 for details) and applies to any font file that is not installed in the default fonts directory.

Although the KB article for MS14-045 lists this as a "known issue" it is now documented as the expected behaviour. See Font Installation and Deletion in MSDN:

A font installed from a location other than the %windir%\fonts folder cannot be modified when loaded in any active session, including session 0. [...]

Permanent fonts remain installed after reboot and are loaded by all created sessions.

This means that if it is not acceptable to have to reboot the machine when upgrading the font, the font file must be installed in the default fonts directory. (I believe this has always been the recommended practice in any case.)

Community
  • 1
  • 1
Harry Johnston
  • 35,639
  • 6
  • 68
  • 158
  • 1
    To summarize: (1) uninstall the font in question, (2) Remove its reference from 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Fonts' and reboot. Elevating permissions, taking owership or killing 'fontdrvhost.exe' won't work. I know this is an old question but it is first result in google and I really struggled to figure it out today. – rvnlord Nov 01 '18 at 21:13
  • @rvnlord, the `handles.exe` utility (available from Microsoft's web site) can be useful in identifying who has a particular file open. But the only *supported* way to remove a font file in this scenario is to unregister the font and then reboot. Killing all the processes that have the file open might or might not work, but even if it did it would likely leave the system so unstable that you'd then need to reboot anyway. :-) – Harry Johnston Nov 01 '18 at 21:20