Windows File Protection System Event Logs
Posted on 2004-09-08
A few days after a new Win2K OS install, I am finding numerous logs in the System event viewer that read:
Windows File Protection
File replacement was attempted on the protected system file c:\winnt\system32\XXXXXX. This file was restored to the original version to maintain system stability. The file version of the bad file is 220.127.116.11, the version of the system file is 18.104.22.168.
No one was working on nor logged into the server during the times of these logs.
What would cause windows to activate the FPS on such files?