Windows File Protection Creates Event Log Entry When Scanning Is Stopped

ID: Q236801

The information in this article applies to:

Microsoft Windows 2000 Advanced Server
Microsoft Windows 2000 Professional
Microsoft Windows 2000 Server
Microsoft Windows 2000 Datacenter Server

SUMMARY

The Windows File Protection feature (WFP) logs an event if WFP is canceled while it is performing a scan of the system files or attempting to replace an individual file. This information is recorded for later review in the System event log.

MORE INFORMATION

Event ID 6406

Event ID 6406 indicates that a user canceled the replacement of a file that WFP targeted to be replaced and for which WFP prompted the user for the media source.

Event ID 6406
Type: Informational
Source: Windows File Protection
Description: The system file Filename was not restored to its original, valid version because the WFP restoration process was canceled by user interaction, user name is UserID.

Event ID 6409

Event ID 6409 indicates that a user canceled the scanning process completely.

Event ID: 6409
Type: Informational
Source: Windows File Protection
Description: The WFP file scan was canceled by user interaction, user name was UserID.

Additional query words: sfc sfc.exe

Keywords : kbtool
Version : WINDOWS:2000
Platform : WINDOWS
Issue type : kbinfo