SUMMARY
You can use Windows File Protection (a new feature in
Windows 2000) to prevent certain monitored or protected system files from being
replaced. If you prevent these system files from being replaced, you can avoid
file version mismatches. Windows File Protection runs in the background on a
Windows 2000-based computer and protects all .sys, .dll, .exe, and .ocx files
that are shipped on the Windows 2000 CD. Windows File Protection also protects
some TrueType font files, including Micros.ttf, Tahoma.ttf, and Tahomabd.ttf.
This step-by-step article describes how to verify that the Windows File
Protection feature is running and protecting your system files.
back to the top
How to Verify that Windows File Protection Is Running
- Start Microsoft Windows Explorer, and then open the
WINNT\system32 folder.
- Right-click the Winmine.exe file, and then click Rename.
- Type Winmine.old to rename the
executable file for the Microsoft Windows Minesweeper game.
- Wait a few moments, and then note that Windows replaces the
missing Winmine.exe file.
You may need to scroll to the top or the
bottom of the file list to confirm that the file is displayed again.
If Windows replaces the missing Winmine.exe file, the Windows
File Protection feature is protecting your files.
NOTE: When Windows File Protection restores a file, a log entry is
logged in System Event Viewer that is similar to the following entry:
File replacement was attempted on the protected system file C:\Windows\System32\Winmine.exe. This file was restored to the original version to maintain system stability. The file version of the system file is 5.1.2600.0.
REFERENCES
For additional information about
the Windows 2000 Windows File Protection feature, click the article numbers
below to view the articles in the Microsoft Knowledge Base:
222193 Description of the Windows 2000 Windows File Protection Feature
222471 Description of the Windows System File Checker Tool
236801 WFP Creates Event Log Entry When Scanning Is Stopped