Windows File Protection: Difference between revisions

Revision as of 07:28, 1 February 2010

Revision as of 17:38, 3 April 2011

Line 2:

== Operation ==

With Windows File Protection active, replacing or deleting a system file that has no [[File locking|file lock]] to prevent it getting overwritten causes Windows to immediately and silently to restore the original copy of the file. The original version of the file is restored from a cached folder which contains backup copies of these files. The [[Windows NT]] family uses the cached folder <tt>%WinDir%\System32\Dllcache</tt>. [[Windows Me]] caches its entire set of compressed cabinet setup files and stores them in the <tt>%Systemroot%\Options\Install</tt> folder.

WFP covers all files which the operating system installs (such as <tt>DLL</tt>, <tt>EXE</tt>, <tt>SYS</tt>, <tt>OCX</tt> etc.), protecting them from deletion or from replacement by older versions. The [[digital signature]]s of these files are checked using [[code signing]] and the signature catalog files stored in the <tt>%Systemroot%\system32\catRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}</tt> folder. Only certain operating system components such as the ''Package Installer'' (Update.exe) or [[Windows Installer]] (Msiexec.exe) can replace these files. Changes made using any other methods in order to replace these files are reverted and the files are silently restored from the cache. If Windows File Protection cannot automatically find the file in the cached folder, it searches the network path or prompts the user for the Windows installation disc to restore the appropriate version of the file.