Windows file protection
Jeffrey A. Ferris

Windows 2000 has a feature that can help prevent your system's possible descent into "DLL Hell." In this tip from Jeffrey Ferris's book Windows 2000 Deployment and Desktop Management, published by New Riders, Ferris describes Windows 2000's Windows file protection feature.

Anyone who has worked with Windows for a while is probably familiar with the problems surrounding improperly behaving application installs and DLL conflicts. Occasionally, an application installs a different version of a system DLL, and other applications fail to run correctly. This problem is often referred to as "DLL Hell." Although not a component of the windows Installer service, Windows 2000 file protection is an important concept related to application management and repair.

Windows 2000 protects important system files--including DLL files, system executables, *.SYS files, ActiveX controls, critical system fonts and more--from being overwritten by third-party applications. All files critical to the functions of Windows 2000 are protected, up to the limits of the file protection cache size. Windows 2000 Professional has a default file protection cache size of 4294967295MB. The default cache size can be modified through the Computer Configuration\Administrative Templates\System\Windows File Protection\Limit Windows File Protection cache size policy. Protected files have backup copies located in the %systemroot%\system32\dllcache folder. If a protected file is deleted, modified, renamed, or moved, the Windows File Protection feature restores the copy of the original file to the proper location.

You can't use Windows Explorer to browse to the %systemroot%\system32\dllcache folder unless you have configured your folder options to show hidden files and folders, and not hide protected operating system files--but typing %systemroot%\system32\dllcache in the Run box will open an Explorer window in the folder. To see Windows File Protection in action, go to your system root folder (usually C:\WINNT) and find the NOTEPAD.EXE file. You may need to click the Show Files line in the left column to see the Windows 2000 System Files. Highlight NOTEPAD.EXE and press the Delete key. The Confirm File Delete dialog box will ask if you're sure you want to delete Notepad. Click Yes. In less than five seconds, the NOTEPAD.EXE file will be restored automatically. In addition, the System Log of the Event Viewer will log an informational event.

Now suppose that, for some reason, you want to modify or delete a file protected by Windows File Protection. For example, you want to replace NOTEPAD.EXE with your own version of a plain-text editor. If you modify the NOTEPAD.EXE file in the %systemroot%\system32\dllcache folder, you can delete the system file %systemroot%\NOTEPAD.EXE and it will be replaced by the modified version from the DLLCACHE folder. Keep in mind that changing files in this manner could cause system instability, the files are protected for a reason.

Why would I tell you about a process that could make your system unstable? You may want to remove some files known to be non-critical, such as SOL.EXE (the Solitaire executable), but SOL.EXE is a protected file, so you wouldn't be able to delete it through Explorer. You must delete the file from the DLLCACHE folder. It can be rather frustrating to continually delete a file only to have it reappear seconds later. Of course, with optional Windows components such as Solitaire, the suggested removal method is to uninstall the application through the Add/Remove Programs applet of the Control Panel, under Add/Remove Windows Components. This removes the application without the headache of dealing with Windows file protection.

Click here to learn more about Windows 2000 Deployment and Desktop Management.