I don't need everyone jumping on -board telling me this is a SEP file or that it is part of NTP. I know all that already.
I don't need to know that if I uninstall NTP the error messages generated will go away, I know that too.
What I do need, is to know why, after 2 years, this file file is still creeping up and giving errors:
* * * * * * * *
Event ID 6281 - Microsoft Windows Security Auditing.
Code Integrity determined that the page hashes of an image file are not valid. The file could be improperly signed without page hashes or corrupt due to unauthorized modification. The invalid hashes could indicate a potential disk device error.
File Name: \Device\HarddiskVolume2\Windows\System32\sysfer.dll
* * * * * * * * *
I have this all over my network in all of my security logs...
* * * * * * * * * *
SEPM server is 12.1 RU1 MP1
SEP 12.1 clients 12.1 RU1 MP1
All workstations are Windows 7 x64 Enterprise