Non-Administrator User Is Not Prompted for Installation Media by Windows File Protection (258911)


The information in this article applies to:

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Professional
This article was previously published under Q258911

SYMPTOMS

When a normal user (non-Administrator) is logged on to a Microsoft Windows 2000 Professional-based computer and Windows File Protection (WFP) prompts the user for an installation CD-ROM to replace a protected file, the user may not receive the prompt on their desktop.

CAUSE

This behavior occurs because WFP uses Winlogon as the protection service that is running in the context of the system account. WFP does not interact with normal users.

STATUS

This behavior is by design.

MORE INFORMATION

When an administrator logs on, WFP waits for input by displaying one of the following messages.
  • If Windows 2000 was installed from a network share or CD-ROM, the following message is displayed:
    Windows File Protection

    Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original version of these files.

    Insert Windows 2000 Professional CD-ROM now.
  • If Windows 2000 was installed using Remote Installation Service (RIS), the following message is displayed:
    Windows File Protection

    Files that are required for Windows to run properly have been replaced by unrecognized versions. To maintain system stability, Windows must restore the original version of these files.

    The network location from which the files should be copied, \\Ris_server_name\Reminst, is not available.

    Contact your system administrator or insert Windows 2000 Professional CD-ROM now.
NOTE: If the computer is configured to participate in a workgroup or in a different domain, you may be prompted for a user name and password to connect to the RIS server. The \\Ris_server_name\Reminst share must have the "Authenticated Users" group with read access permissions applied. You must then supply a valid user name and password (where the user name is in the form of Domain.com\Username, and Domain.com is the domain location of the RIS server). After you establish a valid connection, WFP copies the file(s) from the image source folder.

Normally, WFP posts system event log messages when a protected file is replaced, but the event message is not posted until the WFP dialog box is answered. Because typical users do not know that WFP is prompting them for the installation source, the computer may be restarted before the WFP dialog box is answered. In this situation, the following message is posted in the event log during a system shutdown:
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64008
Date: current_date
Time: current_time
User: N/A
Computer: MYMACHINENAME
Description: The protected system file C:\winnt\system32\File_Name.exe could not be verified as valid because Windows File Protection is terminating. Use the SFC utility to verify the integrity of the file at a later time.
For additional information about WFP, click the article number below to view the article in the Microsoft Knowledge Base:

222193 Description of the Windows 2000 Windows File Protection Feature

For additional information, click the article numbers below to view the articles in the Microsoft Knowledge Base:

222471 Description of the Windows 2000 System File Checker Tool

258955 RIS clients get prompted by Windows File Protection for Installation Media.

Modification Type:MajorLast Reviewed:10/29/2003
Keywords:kbenv kbprb KB258911
©2003 Microsoft Corporation. All rights reserved.