Windows File Protection
Windows File Protection (WFP) is a technology included in all Microsoft Windows operating systems beginning with Windows 2000 to prevent programs from replacing critical Windows system files. Protecting core system files prevents problems such as DLL hell with programs and the operating system. Windows 2000, Windows XP and Windows Server 2003 include it under the name of Windows File Protection, Windows Me includes it as System File Protection, whereas Windows Vista includes Windows Resource Protection which expands the technology to protect core registry keys and values and prevent potentially damaging system configuration changes.
When Windows File Protection is active, replacing or deleting a system file that has no file lock to prevent it from being overwritten, causes Windows to immediately and silently restore the original copy of the file. The original version of the file is restored from a cached folder which contains backup copies of these files. For the Windows NT family, the cached folder is located at %WinDir%\System32\Dllcache. Windows Me stores the cache at a different location.
Windows File Protection protects critical system files that are installed as part of Windows (for example, files with a .dll, .exe, .ocx, and .sys extension and some TrueType fonts). Windows File Protection uses the file signatures and catalog files that are generated by code signing to verify if protected system files are the correct versions. Replacement of protected system files is supported only through the following mechanisms:
- Windows Service Pack installation using Update.exe
- Hotfixes installed using Hotfix.exe or Update.exe
- Operating system upgrades using Winnt32.exe
- Windows Update
If a program uses a different method to replace protected files, Windows File Protection restores the original files. The Windows Installer adheres to Windows File Protection when installing critical system files and calls Windows File Protection with a request to install or replace the protected file instead of trying to install or replace a protected file itself. If Windows File Protection cannot automatically find the file in the cached folder, it searches the network path or prompts the user for the Windows installation disc to restore the appropriate version of the file.