Troubleshooting Strategies

System File Checker

System File Checker (SFC) is a command-line tool that scans all protected system files and replaces incorrect versions with correct versions. It is part of the Windows File Protection (WFP) feature of Windows 2000.

The WFP feature provides protection for system files using two mechanisms. The first mechanism runs in the background. The WFP feature is implemented when it is notified that a file in a protected folder is modified. Once this notification is received, WFP determines which file was changed. If the file is protected, WFP looks up the file signature in a catalog file to determine if the new file is the correct version. If it is not, the file is replaced from the %SystemRoot%\System32\Dllcache folder or the distribution media. By default, WFP displays the following message to an administrator:

A file replacement was attempted on the protected system file <file name>. To maintain system stability, the file has been restored to the correct Microsoft version. If problems occur with your application, please contact the application vendor for support.

The second WFP mechanism is SFC, which gives an administrator the ability to scan all protected files to verify their versions. SFC also checks and repopulates the Dllcache folder. The administrator can initiate a full scan of all system files, using either the /scanonce or /scanboot switches on SFC. If the Dllcache folder becomes damaged or unusable, you can use SFC with the /purgecache switch to remove the contents of the Dllcache folder, and copy the files from the Windows 2000 Setup CD again. All SYS, DLL, EXE, TTF, FON, and OCX files included on the Windows 2000 Setup CD are protected. By default, all versions of Windows 2000 Server cache all system files by default to ensure server reliability. Again, all versions of Windows 2000 Professional cache only the most critical system files.

The syntax for SFC is as follows:

sfc [/scannow] [/scanonce] [/scanboot] [/cancel] [/enable] [/purgecache] [/cache size=x] [/quiet]

The SFC switches are listed in Table 14.4.

Table 14.4 SFC Switches

Switch	Description
/scannow	Scans all protected system files immediately.
/scanonce	Scans all protected system files once at the next boot.
/scanboot	Scans all protected system files at every restart.
/cancel	Cancels all pending scans of protected system files.
/quiet	Replaces all incorrect file versions without prompting the user.
/enable	Enables WFP for normal operation.
/purgecache	Purges the file cache and scans all protected system files immediately.
/cachesize=x	Sets the file cache size in bytes. This change does not take effect until you restart the computer.
/?	Displays this list.