What is Windows File Protection? How to disable or enable it on Windows? How does it work? If you are looking for the answers to the above questions, you can refer to this post. This post provides details about Windows File Protection for you.
What Is Windows File Protection
What is Windows File Protection? It is also called WFP. Windows File Protection first debuted with Windows 2000, followed by other subsequent versions of Windows, such as Windows XP and Windows Server 2003.
Tip: To get more information about Windows operating systems, you can go to the MiniTool official website.
It prevents programs from replacing critical Windows system files. Programs must not overwrite these files because they are used by the operating system and other programs. Protecting these files prevents problems with programs and the operating system.
WFP protects critical system files installed as part of Windows (for example, files with .dll, .exe, .ocx, and .sys extensions, and some True Type fonts). WFP uses code signing-generated file signatures and catalog files to verify that protected system files are the correct Microsoft versions. Replacing protected system files is supported only through the following mechanisms:
- Install Windows Service Packs using Update.exe
- Hotfixes are installed using Hotfix.exe or Update.exe
- Upgrading the Operating System Using Winnt32.exe
- Windows update
How Does Windows File Protection Work
The WFP feature uses two mechanisms to protect system files. The first mechanism runs in the background. This protection is triggered after WFP receives a directory change notification for a file in the protected directory.
After WFP receives this notification, WFP determines which file was changed. If the file is protected, WFP looks for the file signature in the catalog file to determine if the new file is the correct version.
If the file version is incorrect, WFP replaces the new file with the file from the cache folder (if it is there) or from the installation source. WFP searches for the correct file in the following locations, in the following order:
- Cache folder (by default, %systemroot%\system32\dllcache).
- Network installation path, if the system was installed using network installation.
- Windows CD-ROM, if the system was installed from a CD-ROM.
The second protection mechanism provided by the WFP feature is the System File Checker tool. At the end of GUI mode installation, the System File Checker tool scans all protected files to ensure that they have not been modified by programs that used unattended installation.
The System File Checker tool also checks all catalog files to track correct file versions. If any catalog file is missing or corrupted, WFP will rename the affected catalog file and retrieve the cached version of the file from the cache folder. If a cached copy of the catalog file is not available in the cache folder, WFP functionality requests the appropriate media to retrieve a new copy of the catalog file.
How to Enable/Disable Windows File Protection
You may have to turn the Windows File Protection feature on or off in some configurations. You can enable or disable Windows File Protection via Registry Editor. Here is how to do that:
Step 1: Press the Windows key and the R key at the same time to open the Run dialog.
Step 2: Type regedit and then press Enter to open Registry Editor. You’ll be prompted for permission and please click Yes to open it.
Step 3: Navigate to the following registry key:
Computer\HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Step 3: Find the SFCDisable key and double-click it. If it doesn’t exist, create it by right-clicking the Winlogon folder and choosing New > DWORD (32-bit value).
Step 4: Set the value to one of the following based on your needs:
- 1 – disabled, prompt at boot to re-enable
- 2 – disabled at next boot only, no prompt to re-enable
- 4 – enabled, with popups disabled
- ffffff9d – for completely disabled
- 0 – Enabled
Step 4: Restart Windows. You may receive a message at startup that says “Windows File Protection is not active on this system. Would you like to enable Windows File Protection now? This will enable Windows File Protection until the next system restart.” Choosing Yes will reactivate Windows File Protection and the message will appear at every login until SFCDisable is set to 0 again.
Tip: There is another way to protect your files and folder – back up them regularly. To do that, it’s recommended to use the professional backup program – MiniTool ShadowMaker. It supports backing up files, folders, partitions, as well as systems. Now, download and try it.
About The Author
Position: Columnist
Having been an editor at MiniTool since graduating college as an English major, Daisy specializes in writing about data backups, disk cloning, and file syncing as well as general computer knowledge and issues. In her free time, Daisy enjoys running and going with friends to the amusement park.