Microsoft KB Archive/258911

= Non-Administrator User Is Not Prompted for Installation Media by Windows File Protection =

Article ID: 258911

Article Last Modified on 11/1/2006

-

APPLIES TO


 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Professional Edition

-



This article was previously published under Q258911





SYMPTOMS
When a normal user (non-Administrator) is logged on to a Microsoft Windows 2000 Professional-based computer and Windows File Protection (WFP) prompts the user for an installation CD-ROM to replace a protected file, the user may not receive the prompt on their desktop.



CAUSE
This behavior occurs because WFP uses Winlogon as the protection service that is running in the context of the system account. WFP does not interact with normal users.



STATUS
This behavior is by design.



MORE INFORMATION
When an administrator logs on, WFP waits for input by displaying one of the following messages.  If Windows 2000 was installed from a network share or CD-ROM, the following message is displayed:

Windows File Protection

Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original version of these files.

Insert Windows 2000 Professional CD-ROM now.

 If Windows 2000 was installed using Remote Installation Service (RIS), the following message is displayed:

Windows File Protection

Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original version of these files.

The network location from which the files should be copied, \\Ris_server_name\Reminst, is not available.

Contact your system administrator or insert Windows 2000 Professional CD-ROM now.



NOTE: If the computer is configured to participate in a workgroup or in a different domain, you may be prompted for a user name and password to connect to the RIS server. The \\ \Reminst share must have the &quot;Authenticated Users&quot; group with read access permissions applied. You must then supply a valid user name and password (where the user name is in the form of Domain.com\, and Domain.com is the domain location of the RIS server). After you establish a valid connection, WFP copies the file(s) from the image source folder.

Normally, WFP posts system event log messages when a protected file is replaced, but the event message is not posted until the WFP dialog box is answered. Because typical users do not know that WFP is prompting them for the installation source, the computer may be restarted before the WFP dialog box is answered. In this situation, the following message is posted in the event log during a system shutdown:

Event Type: Information

Event Source: Windows File Protection

Event Category: None

Event ID: 64008

Date: current_date

Time: current_time

User: N/A

Computer: MYMACHINENAME

Description: The protected system file C:\winnt\system32\File_Name.exe could not be verified as valid because Windows File Protection is terminating. Use the SFC utility to verify the integrity of the file at a later time.

For additional information about WFP, click the article number below to view the article in the Microsoft Knowledge Base:

222193 Description of the Windows 2000 Windows File Protection Feature

For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base:

222471 Description of the Windows 2000 System File Checker Tool

258955 RIS clients get prompted by Windows File Protection for Installation Media.

Additional query words: ripprep w2000ris

Keywords: kbenv kbprb KB258911

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.