JSI Tip 3234. A non-administrator is NOT prompted for the installation media by WFP?

When a protected file is replaced, WFP prompts for an installation CD-ROM to restore the protected file, if it is NOT in the Dllcache.

NOTE: If the SourcePath and ServicePackSourcePath are set, no prompt is issued, assuming the paths are available.

When a non-administrator is logged on to Windows 2000, and replaces a file, the user may NOT receive the prompt.

WFP uses Winlogon, running in the System account context, and by design, does NOT interact with normal users. Even though the prompt may be issued, it is NOT visible on the users' desktop.

When a member of the Administrators group logs on, WFP issues one of the following prompts:

             Windows File Protection

             Files that are required for Windows to run properly have been replaced by unrecognized versions. 
             To maintain system stability, Windows must restore the original version of these files.

             Insert Windows 2000 Professional CD-ROM now.

If Windows 2000 was installed using RIS:

             Windows File Protection

             Files that are required for Windows to run properly have been replaced by unrecognized versions.
             To maintain system stability, Windows must restore the original version of these files.

             The network location from which the files should be copied, \\<RIS Server>\Reminst, is not available.

             Contact your system administrator or insert Windows 2000 Professional CD-ROM now.

NOTE: If the computer is configured to participate in a workgroup or in a different domain, you may be prompted for a user name and password to connect to the RIS server. The Authenticated Users group must be granted Read permissions on the \\<RIS Server>\Reminst share. You must enter the <DomainName.com\UserName> and password of a privileged user in the RIS servers' domain.

If the computer is rebooted before the WFP prompt is answered, the event log will contain:

        Event Type: Information
        Event Source: Windows File Protection
        Event Category: None
        Event ID: 64008
        Date: current_date
        Time: current_time
        User: N/A
        Computer: COMPUTERNAME
        Description: The protected system file C:\winnt\system32\<File Name>.exe could not
                     be verified as valid because Windows File Protection is terminating. 
                     Use the SFC utility to verify the integrity of the file at a later time.

Comments

Plain text