JSI Tip 2134. Windows File Protection event log entries.

Jerold Schulman

March 9, 2000

1 Min Read
ITPro Today logo in a gray background | ITPro Today


When SFC is run, it is possible for a user to cancel a file replacement, or the entire run.

If a user cancels a file replacement, Event ID 6406 is logged. If they cancel the entire scan, Event ID 6409 is logged:

   Event ID 6406   Type: Informational   Source: Windows File Protection   Description: The system file Filename was not restored to its original, valid version because                the WFP restoration process was canceled by user interaction, user name is UserID.    Event ID: 6409   Type: Informational   Source: Windows File Protection   Description: The WFP file scan was canceled by user interaction, user name was UserID. 


Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.

You May Also Like