Windows File Protection and the DLL Cache

Windows® File Protection (WFP) prevents the replacement of essential system files installed as part of Windows. Applications should not overwrite these files because they are used by the system and other applications. Protecting these files prevents application and operating system failures.

Protected File List

WFP protects files with the following extensions that are installed by Windows: .dll, .exe, .ocx, and .sys. In addition, the TrueType fonts Micross.ttf, Tahoma.ttf, and Tahomabd.ttf are also protected.

At the end of the Windows installation, WFP runs a scan of all protected files to ensure they have not been modified by applications installed through unattended installation. WFP also copies verified versions of these system files to the cache directory. When an application attempts to replace a protected file, WFP can restore the original file from the cache directory.

The default value is %systemroot%\system32\dllcache. To specify a different location for the cache, create the following registry value.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDllCacheDir

This must be a local path. Using a network path creates a single shared network source for cache files, provided all clients using the share are running the same service packs and hotfixes.

The default size of the cache is unlimited. To change the size of the cache, use the following registry setting:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCQuota

If the value is SFC_QUOTA_ALL_FILES, all system files will be cached in the cache directory.

Due to disk space considerations, it may not be desirable to maintain cached versions of all system files in the cache directory. Depending on the size of the cache, WFP will store verified file versions in the cache directory on the system hard drive. WFP will add files to the cache until the size of the cache directory reaches the specified limit.

When an application attempts to replace a protected file that is not in the cache, WFP attempts to restore the original file from the installation source, prompting the user if necessary.