Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Several users in my office all reported on the same day that they were getting "Windows File Protection" messages. It wasn't after windows updates or other software/drivers were pushed.

I generally assume driver updates and windows updates will cause this, and it is no cause for concern. This time, however, I'm curious what caused it.

Can anyone shed some light on this? How can I find which files were modified?

share|improve this question
    
Whoa, there's another person on this site named J McKinnon? I was just scanning recent questions, and just happened to notice the name next to this question and thought "hey, I didn't ask that!" and then realized it was indeed not me... ;-) –  Jessica McKinnon Aug 31 '09 at 16:18
    
Indeed - I noticed there being another McKinnon as well. I am surprised it didn't pick up my full name from Stack Overflow... –  Joshua McKinnon Sep 1 '09 at 2:34
add comment

1 Answer

up vote 1 down vote accepted

The System File Checker tool gives an administrator the ability to scan all the protected files to verify their versions. Use "sfc" command-line tool

UPD: in comments

share|improve this answer
    
This is good to know, but it still won't give me any information on which file(s) were modified. There may not be a better answer though, so if one doesn't come in then in a week I will accept... –  Joshua McKinnon Sep 1 '09 at 2:38
    
My answer "sfc /SCANNOW" just tries to repair these files using an original CD. I found no tools to list changed files, sorry. The idea is to compare files in "%WinDir%\System32\Dllcache" with their digital signatures in "%Systemroot%\system32\catRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}". –  kolypto Sep 1 '09 at 11:00
    
accepted - it's worth pushing your above commentinto the answer, I think it's helpful. I also found microsoft.com/whdc/archive/wfp.mspx was a nice summary –  Joshua McKinnon Sep 8 '09 at 14:06
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.