When a non-administrator is logged on to Windows 2000, and replaces a file, the user may NOT receive the prompt.
WFP uses Winlogon, running in the System account context, and by design, does NOT interact with normal users. Even though the prompt may be issued, it is NOT visible on the users' desktop.
When a member of the Administrators group logs on, WFP issues one of the following prompts:
Windows File Protection Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original version of these files. Insert Windows 2000 Professional CD-ROM now.If Windows 2000 was installed using RIS:
Windows File Protection Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original version of these files. The network location from which the files should be copied, \\<RIS Server>\Reminst, is not available. Contact your system administrator or insert Windows 2000 Professional CD-ROM now.NOTE: If the computer is configured to participate in a workgroup or in a different domain, you may be prompted for a user name and password to connect to the RIS server. The Authenticated Users group must be granted Read permissions on the \\<RIS Server>\Reminst share. You must enter the <DomainName.com\UserName> and password of a privileged user in the RIS servers' domain.
If the computer is rebooted before the WFP prompt is answered, the event log will contain:
Event Type: Information Event Source: Windows File Protection Event Category: None Event ID: 64008 Date: current_date Time: current_time User: N/A Computer: COMPUTERNAME Description: The protected system file C:\winnt\system32\<File Name>.exe could not be verified as valid because Windows File Protection is terminating. Use the SFC utility to verify the integrity of the file at a later time.