Sign up for the ITPro Today newsletter
Stay on top of the IT universe with commentary, news analysis, how-to's, and tips delivered to your inbox daily.
March 9, 2000
When SFC is run, it is possible for a user to cancel a file replacement, or the entire run.
If a user cancels a file replacement, Event ID 6406 is logged. If they cancel the entire scan, Event ID 6409 is logged:
Event ID 6406 Type: Informational Source: Windows File Protection Description: The system file Filename was not restored to its original, valid version because the WFP restoration process was canceled by user interaction, user name is UserID. Event ID: 6409 Type: Informational Source: Windows File Protection Description: The WFP file scan was canceled by user interaction, user name was UserID.
You May Also Like