Windows File Protection

Windows File Protection (WFP) is a technology included in all Microsoft Windows operating systems beginning with Windows 2000 to prevent programs from replacing critical Windows system files. Protecting core system files prevents problems such as DLL hell with programs and the operating system. Windows 2000, Windows XP and Windows Server 2003 include it under the name of "Windows File Protection"; Windows Me includes it as "System File Protection".

When Windows File Protection is active, replacing or deleting a system file that has no file lock to prevent it from being overwritten causes Windows to immediately and silently restore the original copy of the file. The original version of the file is restored from a cached folder which contains backup copies of these files. For the Windows NT family, the cached folder is located at %WinDir%System32Dllcache. Windows Me caches its entire set of compressed cabinet setup files and stores them in the %Systemroot%OptionsInstall folder.

All files which are installed by the operating system (such as DLL, EXE, SYS, OCX etc.) are protected from deletion or being replaced by older versions. The digital signatures of these files are checked using code signing and the signature catalog files stored in the %Systemroot%system32catRoot{F750E6C3-38EE-11D1-85E5-00C04FC295EE} folder. Only certain operating system components such as the "Package Installer" (Update.exe) or Windows Installer (Msiexec.exe) can replace these files. Changes made using any other methods in order to replace these files are reverted and the files are silently restored from the cache. If Windows File Protection cannot automatically find the file in the cached folder, it searches the network path or prompts the user for the Windows installation disc to restore the appropriate version of the file.

Windows Vista does not include Windows File Protection, but it includes Windows Resource Protection which protects files using ACLs. Windows Resource Protection aims to protect core registry keys and values and prevent potentially damaging system configuration changes, besides operating system files.

See also

*Windows Resource Protection
*System File Checker
*Access Control List
*Security Identifier

External links

* [http://support.microsoft.com/kb/222193 Overview of Windows File Protection]
* [http://support.microsoft.com/kb/222473 Registry settings for Windows File Protection]
* [http://www.microsoft.com/whdc/archive/wfp.mspx Whitepaper on Windows File Protection]
* [http://support.microsoft.com/kb/253571 Overview of System File Protection (Windows Me)]
* [http://www.bitsum.com/aboutwfp.asp Hacking Windows File Protection]