This is true, but most OEM computers and many shop-built computers that
do not provide an installation CD, do include the i386 folder on the C:
drive, at C:\i386. This folder is from the XP installation CD and
contains the installation files, as I'm sure you know. If the OEM or
system builder set the correct Registry entries, the SourcePath will
point to the folder at C: rather than pointing to the CD drive, and the
user will not be prompted for the CD. Otherwise, if the folder is
present, the user will have to change the Sourcepath value, and probably
also change the CDInstall value to 0.
So, in some cases, there will be no CD prompt, depending on how the OEM
adjusted the Registry settings at
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Setup
sfc /scannow should look for updated service pack files in the locations
automatically added to the file system and to that Registry key at
ServicePackSourcePath and ServicePackCachePath. These registry values
are added when a service pack is installed, and SFC uses them also.
They should point to WINDOWS\ServicePackFiles and
C:\Windows\ServicePackFiles\ServicePackCache (there is an i386 folder in
both locations, but the Registry value must point to the parent folder).
Your information above is totally incorrect. sfc /scannow checks all
protected system files (which includes more than just files in the
System32 folder), and replaces missing or corrupted files with copies
from the dllcache folder if they are there, or from the source folders I
mentioned above, on the CD or the C: drive, if the files are not
available from the dllcache folder. It will also replace a corrupt file
in the dllcache folder.
Description of Windows XP and Windows Server 2003 System File Checker
(Sfc.exe)
http://support.microsoft.com/kb/310747
scannow sfc - LEARN how to use SFC.EXE (please read this entire web
page)
http://www.updatexp.com/scannow-sfc.html
Description of the Windows File Protection featurehttp://support.microsoft.com/kb/222193
Windows File Protectionhttp://
www.updatexp.com/windows-file-protection.html
The sfc /scannow runs one time when you install XP to populate the
dllcache folder.
I already know how to change the registry to tell sfc where to look to
get files.
Here is a test you can do to see how it works (and how it doesn't
work):
Windows File Protections monitors certain directories in real time for
any changes and then decides what to do.
You can test it by doing this:
Boot your system normally and rename one of the 3498 files (there is a
list) that Windows File Protection looks after.... like c:\windows
\system32\taskmgr.exe to something you can remember:
rename c:\windows\system32\taskmgr.exe c:\windows
\system32\taskmgr.bak
If your Windows File Protection is not afflicted, the "missing"
taskmgr.exe file will be quickly and silently replaced and the event
will be logged in the Event Viewer System log as follows:
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Description:
File replacement was attempted on the protected system file c:\windows
\system32\taskmgr.exe. This file was restored to the original version
to maintain system stability. The file version of the system file is
5.1.2600.5512.
You will see the same thing if you delete taskmgr.exe - it will be
replaced since Windows File Protection is working.
Boot your system in Safe Mode so Windows File Protection is not
running and "missing" files are not automatically replaced.
From the list of 3498 protected file (there is a list) pick one that
Windows XP looks after (like taskmgr.exe) and rename it to something
you can remember:
rename c:\windows\system32\taskmgr.exe c:\windows
\system32\taskmgr.bak
The "missing" taskmgr.exe file will not be replaced since Windows File
Protection is not running in Safe Mode.
Verify taskmgr.exe is now "missing" and Task Manager no longer
functions using the usual keyboard shortcuts or from the Taskbar.
You will also see that the taskmgr.exe file will not be replaced as in
a Normal boot since Windows File Protection is not running and is not
monitoring any directories for changes.
Reboot normally and taskmgr.exe will still be missing since Windows
File Protection has not detected any directory modifications in the
folders it looks after - your taskmgr.exe file is still missing. No
"missing" files are automatically replaced on a reboot (another
rumor).
Some folks thinks that missing protected file are automatically
replaced on a system reboot, but that is not the case either since
that is not how Windows File Protection works.
Now would be a good time to run sfc /scannow and you will see that
when sfc /scannow completes, c:\windows\system32\taskmgr.exe will
still be missing. This supports the notion that running sfc /scannow
does not replace any critical system files that are missing (or
corrupt).
This is because sfc /scannow only looks after the following folder:
%Systemroot\system32\dllcache
Running sfc /scannow will not replace any missing or corrupt file(s)
in any other folder - especially not the system32 folder. That is not
what sfc /scannow does.
This is just one reason that running sfc /scannow is a waste of time
unless it is your desire to verify the contents of the %Systemroot
\system32\dllcache folder. Since that folder does not come into play
when XP is running, sfc /scannow is really not a very good
troubleshooting suggestion.
Rename the copy of c:\windows\system32\taskmgr.bak to c:\windows
\systm32\taskmgr.exe so your Task Manager is working again.
Now you can do the same sort of test from booting into Safe Mode
again, except this time instead of deleting the taskmgr.exe file, copy
some "bad" file over the top of it to "corrupt" the c:\windows
\system32\taskmgr.exe file like:
copy c:\boot.ini c:\windows\system32\taskmgr.exe
Now you have a taskmgr.exe file but it is "corrupted" and trying to
launch Task manager will fail again since now the taskmgr.exe file is
"corrupt" since it is really just a text tile.
If you reboot normally and run sfc /scannow, it will still not replace
the corrupt c:\windows\system32\taskmgr.exe file either. This
supports the notion that running sfc /scannow does not replace any
corrupted system files either.
Now you know that running sfc /scannow does not replace missing files
and running sfc /scannow does not replace corrupted files in the c:
\windows\system32 folder.
If you repeat the same tests except this time delete the taskmgr.exe
file from the dllcache folder, you can end up with a missing
taskmgr.exe from the dllcache folder and then running sfc /scannow
will indeed replace the missing file, because sfc /scannow does look
after the dllcache folder.
If you repeat the same tests except this time corrupt the taskmgr.exe
file in the dllcache folder, you will end up with a corrupt
taskmgr.exe
in the dllcache folder and then running sfc /scannow will indeed
replace the corrupt file, because sfc /scannow does look after the
dllcache folder.
Running sfc /scannow will only replace missing or corrupt files from
the %Systemroot\system32\dllcache folder. That is what sfc /scannow
does.
For Windows XP (that would be this forum), when sfc /scannow starts
and completes, there is no message displayed after the scan, but there
are events in the Event Log that look like this:
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64016
Description:
Windows File Protection file scan was started.
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64017
Description:
Windows File Protection file scan completed successfully.
Even if sfc /scannow finds a file to replace in the %Systemroot%
\system32\dllcache folder and replaces the file (like it just did when
it replaced your c:\windows\system32\dllcache\taskmgr.exe file) there
is still no message displayed or not event even logged in the Event
Viewer.
So, what is the point of these suggestions we see almost every day to
get folks to try to run sfc /scannow when they have system problems,
or try to run it in Safe Mode (when sfc /scannow will not even run in
Safe Mode) and most folks don't have a genuine bootable XP
installation CD in the first place?
