An Error event that is related to the System Restore filter is added to the Windows XP System log if you repeatedly restart the computer (903264)

The information in this article applies to:

Microsoft Windows XP Professional
Microsoft Windows XP Professional x64 Edition
Microsoft Windows XP Home Edition
Microsoft Windows XP Media Center Edition
Microsoft Windows XP Tablet PC Edition

SYMPTOMS

If you repeatedly restart the Windows XP-based computer, the following Error event entry may be added to the System log: Event Type: Error
Event Source: sr
Event ID: 1
Description:
The System Restore filter encountered the unexpected error '0xC0000035' while processing the file file name on the volume volume name. It has stopped monitoring the volume.
Data:
0000: 00000006 004e0004 00000000 c0000001
0010: 00000000 00000000 00000000 00000000
0020: 00000000 00000000

CAUSE

This issue occurs because System Restore cannot successfully rename the Change.log file. System Restore tracks activities on the volume. System Restore logs those activities in the Change.log file. The Change.log file is created in every restore point folder. When the Windows XP-based computer restarts, the Change.log file is renamed to Change.log.number, where number is the next free number up to 1,000. However, if number reaches 1,000, System Restore cannot successfully rename the Change.log file. If System Restore cannot successfully rename the Change.log file, System Restore stops logging activities.

WORKAROUND

Warning If you use the following workaround and turn off System Restore, all existing restore points are removed. Additionally, you cannot track or undo changes that have been made to the computer.

To work around this issue, turn off System Restore, and then turn on System Restore. For more information about how to turn on and turn off System Restore in Windows XP, click the following article number to view the article in the Microsoft Knowledge Base:

310405 How to turn on and turn off System Restore in Windows XP

Modification Type:	Minor	Last Reviewed:	9/12/2006
Keywords:	kberrmsg kbtshoot kbprb KB903264 kbAudEndUser