Microsoft KB Archive/236801

= Windows File Protection Creates Event Log Entry When Scanning Is Stopped =

Article ID: 236801

Article Last Modified on 2/27/2007

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows 2000 Datacenter Server

-



This article was previously published under Q236801



SUMMARY
The Windows File Protection feature (WFP) logs an event if WFP is canceled while it is performing a scan of the system files or attempting to replace an individual file. This information is recorded for later review in the System event log.



Event ID 6406
Event ID 6406 indicates that a user canceled the replacement of a file that WFP targeted to be replaced and for which WFP prompted the user for the media source.

Event ID 6406

Type: Informational

Source: Windows File Protection

Description: The system file  was not restored to its original, valid version because the WFP restoration process was canceled by user interaction, user name is.

Event ID 6409
Event ID 6409 indicates that a user canceled the scanning process completely.

Event ID: 6409

Type: Informational

Source: Windows File Protection

Description: The WFP file scan was canceled by user interaction, user name was.

Additional query words: sfc sfc.exe

Keywords: kbinfo kbwfp KB236801

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.