Windows File Protection Creates Event Log Entry When Scanning Is Stopped

The Windows File Protection feature (WFP) logs an event if WFP is canceled while it is performing a scan of the system files or attempting to replace an individual file. This information is recorded for later review in the System event log.

Event ID 6406

Event ID 6406 indicates that a user canceled the replacement of a file that WFP targeted to be replaced and for which WFP prompted the user for the media source.

Event ID 6406
Type: Informational
Source: Windows File Protection
Description: The system file Filename was not restored to its original, valid version because the WFP restoration process was canceled by user interaction, user name is UserID.

Event ID 6409

Event ID 6409 indicates that a user canceled the scanning process completely.

Event ID: 6409
Type: Informational
Source: Windows File Protection
Description: The WFP file scan was canceled by user interaction, user name was UserID.