What’s Windows File Protection?

What is the Windows File Protection (WFP) in Windows 2000/XP/2003?

A major cause of incompatibility and crashes in W2K/XP is the fact that an application might overwrite dynamic link library (DLL) files with a similar name belonging to other applications. Often, these are DLL files that get placed in the %systemroot%\System32 folder during an application's installation.

Windows File Protection (WFP) prevents programs from replacing critical Windows system and DLL files. Programs must not overwrite these files because they are used by the operating system and by other programs. Protecting these files prevents problems with programs and the operating system.

WFP protects critical system files that are installed as part of Windows (for example, files with a .dll, .exe, .ocx, and .sys extension and some True Type fonts). WFP uses the file signatures and catalog files that are generated by code signing to verify if protected system files are the correct Microsoft versions. Replacement of protected system files is supported only through the following mechanisms:

* Windows Service Pack installation using Update.exe
* Hotfixes installed using Hotfix.exe or Update.exe
* Operating system upgrades using Winnt32.exe
* Windows Update

If a program uses a different method to replace protected files, WFP restores the original files. The Windows Installer adheres to WFP when installing critical system files and calls WFP with a request to install or replace the protected file instead of trying to install or replace a protected file itself.

Protected System files are backed up each time you perform a System State backup.