how do I find out what replaced my system files?

  • Thread starter Thread starter Celler Dweller
  • Start date Start date
C

Celler Dweller

Hi Everyone,
I need someone to throw a clue in my direction. I have some users that
are receiving the Windows File Protection message about replaced files
and it was prompting them for the win2k CD to restore the originals. I
am being asked to determine what app replaced them and if this is a
security issue. They are looking for documentation on this. Does anyone
know of any?
 
Do users have local admin rights? It's hard to say what did what, if users
are allowed to install software, etc....
 
--------------------
Date: Fri, 11 Jun 2004 10:34:20 -0400
From: Celler Dweller <[email protected]>
Subject: how do I find out what replaced my system files?

Hi Everyone,
I need someone to throw a clue in my direction. I have some users that
are receiving the Windows File Protection message about replaced files
and it was prompting them for the win2k CD to restore the originals. I
am being asked to determine what app replaced them and if this is a
security issue. They are looking for documentation on this. Does anyone
know of any?
Click to expand...
----------------------

For a description of Windows File Protection, see the following article...
Q222193: Description of the Windows File Protection Feature
support.microsoft.com/?id=222193


--
~~ JASON HALL ~~
~ Performance Support Specialist,
~ Microsoft Enterprise Platforms Support
~ This posting is provided "AS IS" with no warranties, and confers no
rights.
~ Use of included script samples are subject to the terms specified at
http://www.microsoft.com/info/cpyright.htm
~ Note: For the benefit of the community-at-large, all responses to this
message are best directed to the newsgroup/thread from which they
originated.
 
Lanwench said:
Do users have local admin rights? It's hard to say what did what, if users
are allowed to install software, etc....
Click to expand...
Hi and thanks for the reply,
I don't believe my user has admin rights. Most do not have admin
privileges, but a very few do. Is there any kind of log file besides the
Event viewer for this?

Thanks
 
You must log in or register to reply here.

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments. After that, you can post your question and our members will help you out.

Ask a Question

Similar Threads

Chkdsk "replacing invalid security id with default id" windows xp 4
What software do you use to convert between audio files? 6
OT corrupted files, how to replace from CD? 21
windows explorer file replace 5
Windows 8 System Restore turned off and 'Turn on system protection' greyed out 1
Has been file replaced? 10
Verifiy and repair system files 12
How do I find an allready replaced document? 1

Back
Top