In my previous post I talked about how FILE_SHARE_DELETE can cause ERROR_ACCESS_DENIED error.

Diagnose access denied error is hard, especially when it only happens under stress.

Fortunately FileMon from sysinternals folks can capture all the file accesses. It greatly helps to diagnose file access problems.

In the case of FILE_SHARE_DELETE cuasing ERROR_ACCESS_DENIED error, FileMon will show it as "DELETE PEND", instead of "ACCESS DENIED".

7190 4:47:18 PM repro.exe:56768 CREATE D:\temp\test.txt DELETE PEND Options: OverwriteIf  Access: All 

But in any case, DELETE PEND == ERROR_ACCESS_DENIED.