You are currently offline, waiting for your internet to reconnect

Registry settings for Windows File Protection

This article was previously published under Q222473
This article applies to Windows 2000. Support for Windows 2000 ends on July 13, 2010. The Windows 2000 End-of-Support Solution Center is a starting point for planning your migration strategy from Windows 2000. For more information see the Microsoft Support Lifecycle Policy.
The following registry key is the primary location for registry settings for Windows File Protection/System File Checker:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
In addition, Windows File Protection/System File Checker settings may also be located in the following registry key:
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Windows File Protection
When Windows starts up, the Windows File Protection service synchronizes (copies) the WFP settings from the following registry key
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Windows File Protection
to the following registry key:
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon
Therefore, if any of the following values are present in the
HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows NT\Windows File Protection
key, they will take precedence over the same values under the
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon

By default, only users with Administrator or System rights can modify these settings.

Registry Values


0 = enabled (default)
1 = disabled, prompt at boot to re-enable
2 = disabled at next boot only, no prompt to re-enable
4 = enabled, with popups disabled

NOTE: For options 1 and 2: Both of these options require a kernel debugger to be hooked up for those options to become useable. If a kernel debugger is not hooked up, Windows File Protection is not disabled.


0 = do not scan protected files at boot (default)
1 = scan protected files at every boot
2 = scan protected files once


n = size (in megabytes) of dllcache quota (default is 0xffffffff or approximately 300 MB)
FFFFFFFF = cache all protected system files on the local hard disk


Path = local or network location of dllcache folder (default is %SystemRoot%\System32)

NOTE: Network shares for the dllcache directory are no longer supported.

SFCShowProgress (REG_DWORD)

0 = System File Checker progress meter is not displayed (default)
1 = System File Checker progress meter is displayed

NOTE: The Windows 2000 source files location information is stored in the following registry location and can be modified to point to the drive letter of a volume that has an I386 flat folder of the installation files or change the SourcePath value in the registry to point to a Universal Naming Convention (UNC) path instead of a mapped network drive.

The SourcePath value is located in the following registry key:

If the I386 directory is at C:\I386, the SourcePath value would be C:\.

If the I386 directory is at \\Servera\w2kflat\I386, the SourcePath value would be \\Servera\W2KFlat.

After you restart the computer, WFP and SFC /SCANNOW uses the new source path instead of prompting for the Windows 2000 installation CD-ROM.
sfc sfp wfp compatguidechange

Article ID: 222473 - Last Review: 02/24/2007 00:35:49 - Revision: 5.4

  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Professional Edition
  • Microsoft Windows 2000 Datacenter Server
  • kbenv kbinfo KB222473