Windows File Protection Error

Topic

New Reply

Constantly getting the following messages on a 2K server. I checked Microsoft’s knowledge base, but they don’t talk of these specific messages. They mention something about Outlook Express when looking up the Event ID’s, but the description they give doesn’t match with the messages I’m getting. Anyone have any ideas about this? I don’t want to blindly put the 2K CD in and let it start restoring files since this is a production server.

The protected system file winver.exe was not restored to its original, valid version because the Windows File Protection restoration process was cancelled by user interaction, user name is Administrator. The file version of the bad file is 5.0.2195.4454.

The Event ID is 64005

File replacement was attempted on the protected system file c:winntsystem32winmsd.exe. This file was restored to the original version to maintain system stability. The file version of the bad file is 5.0.2134.1, the version of the system file is 5.0.2134.1.

The Event ID is 64001

Reply | Quote

Replies

Jrehm–

I’d have no hesitation about putting in the CD and running System File Checker.

I’m not completely clear on what you did do, and I understand we’re talking about a production server. Did those Win File Protection errors come up by themselves? Any specificity on the OE error? Did you retrieve Event Viewer messages from both Application/System at time of errors? From your comment on putting in the CD it makes me think you haven’t run SFC in connection with this.

As you know anything can modify system .dlls and .exes including installation of new applications and when that happens WFC will automatically overwrite them, Win 2K or any server software will try to automatically replace the file from the System 32.dllcache folder and that probably generated any WFC errors for whatever reason. Had the disc happened to be there, they may not have occurred because if the protected replacement file in .dllcache was corrupt, it would have gone up the ladder to the CD to grab the file i.e. using the disc now presents no particular risk, and may fix the situation. I see no downside. In addition, if there is a problem with a file or files in .dllcache, replacing it from the disk may fix the problem generating these errors and put the intact file back in the Windowssystem32.dllcache folder.

One point that is not appreciated by a number of home and small business users, many of whom have not heard of WFP even though Microsoft showcased when they promoted Win 2K and Win XP to system builders and IT, is that running system file checker regularly on an OS or server 2K or 2003 can be as important a part of maintainance as defrag and chkdsk and other routines–and it incereases the probability that the “protected” system files in .dllcache will stay protected. One of the advantages the CD has is that it isn’t impacted by things that can impact .dllcache.

I understand you may have run SFC many times, but if not here is some reference backdrop, and I’d run it now. The way I do it is to first type “sfc /purgecache” at the prompt or the run box–either works, then “sfc /scannow.” With some systems you have to hit “retry in a dialogue box several times, and you’ll get a receipt WFC has run successfully in Event Viewer.

If anyone reads this who isn’t familiar with SFC/WFP, here are a couple reference links:

Updating System Files
Windows File Protection on Windows 2000 and Windows XP

SMBP

Reply | Quote

Thanks for the response. Actually, I have not run SFC on this machine. These messages just started popping up on their own.

Reply | Quote

Jrehm–

These Windows File Protection Messages are a useful symptom and running it may now well be the cure.

Ed. SMBP : I also searched every permuation and combination of the error info you provided–thanks for being specific–at “]http://www.microsoft.com/technet/treeview/…_win2ksvr.asp”> Tech Net Windows (2000) Events and Errors[/url] from the Microsoft Technet Events and Errors Message Center
and came up with no additional informatino, but the principle is that WFP detected damaged files and wanted them fixed.[/size]

SMBP

Reply | Quote

Jrehm–

These Windows File Protection Messages are a useful symptom and running it may now well be the cure.

Ed. SMBP : I also searched every permuation and combination of the error info you provided–thanks for being specific–at “]http://www.microsoft.com/technet/treeview/…_win2ksvr.asp”> Tech Net Windows (2000) Events and Errors[/url] from the Microsoft Technet Events and Errors Message Center
and came up with no additional informatino, but the principle is that WFP detected damaged files and wanted them fixed.[/size]

SMBP

Reply | Quote

Thanks for the response. Actually, I have not run SFC on this machine. These messages just started popping up on their own.

Reply | Quote