Windows File Protection Query v1.00 freeware

A look at Windows File Protection Query v1.00, a freeware that can help find the Windows files that are being protected by WFP.

Windows File Protection prevents changes from being made to certain protected system files. In the event one of

these files is changed, a backup copy of the file is restored from a special repository. The exact list of files that are protected, however, can be a bit mysterious.

The freeware program WFPQuery.exe (available from http://www.optimumx.com/download/#WFPQuery) allows you to display a list of the entire roster of files protected by Windows File Protection, or search for a specific file or list of files that matches a given wildcard.

Wildcards need to use a full path to be effective. For instance, if you pass the command

wfpquery "c:windowssystem32*.dll"

you would see a report that contained all files that matched that wildcard, and an indication of whether or not they were protected by WFP. The program does not traverse directories, however, so you cannot pass a pathname and have the program check everything that matches that wildcard under that folder.

Aside from simply providing a manifest of all protected files, the program can be used to determine if files known to be harmful—viruses or spyware—have been tagged as protected. Some such programs force themselves to be tagged as protected system files to avoid being removed automatically. To delete such a protected file, the user needs to boot into Safe Mode and delete the file from both the system directory and the Windows File Protection repository (the %SYSTEMROOT%System32DllCache directory.) The backup file in the cache should be removed first.


Serdar Yegulalp is the editor of the Windows 2000 Power Users Newsletter. Check out his Windows 2000 blog for his latest advice and musings on the world of Windows network administrators – please share your thoughts as well!


This was first published in September 2004

Dig deeper on Windows Operating System Management

Pro+

Features

Enjoy the benefits of Pro+ membership, learn more and join.

0 comments

Oldest 

Forgot Password?

No problem! Submit your e-mail address below. We'll send you an email containing your password.

Your password has been sent to:

SearchServerVirtualization

SearchCloudComputing

SearchExchange

SearchSQLServer

SearchWinIT

SearchEnterpriseDesktop

SearchVirtualDesktop

Close