I Love Windows File Protection - Not!

[Jon Martin]

A tale of bad programming gone awry, and a cautionary tale concerning
our future ability to push out software upgrades. I work for a company
of 1,800 users and over the past five years my work has included
installing and maintaining an NT domain and Exchange 5.5 system,
automating the rollout of the upgrade from Office 97 to Office 2000,
and upgrading the NT domain/Exchange 5.5 system to Windows AD and
Exchange 2000. Even with that level of experience with Microsoft
products (not to mention using pretty much every MS OS since 1983) I
was surprised at what I went through this past weekend.

Task at hand: Install Office 2000 SR-1 (the same distribution we used
for the Office 2000 rollout at our company).

The target: a Dell GX110 with a newly laid-out copy of Windows 2000
Professional fully patched and updated using the Windows Update
feature.

The installation of Office 2k runs for a while, and then pops up an
error message: "Windows File Protection: must copy files from CDROM of
SP4. Please insert SP4 disk in CDROM Drive." OK, a fully patched and
updated copy of Win2k now includes SP4. With the rollout of SP4
Microsoft has implemented a feature called Windows File Protection,
which ostensibly will protect certain system files and DLLs from being
overwritten, causing system instability, in theory a laudable goal.

Problem number one with this error is that I did not have SP4 on a
CDROM because it had been installed using the Windows Update feature.
So I go out to Microsoft to download the Network Administrator version
of SP4, unzipped it onto my local drive, and burn it to CD.

I burn the SP4 files to disc two ways, copying the i386 folder to the
root of the disk (so that all required files were at least one folder
down) and also burning the contents of the i386 folder to the root (so
that all required files were at the root level), not knowing which way
the system would try to read these files.

Since the installation of the CD burning software required a number of
reboots, I was forced to abandon the installation of Office 2000 where
it errored out. Not wanting some hosed-up partial install on my new
system, I ghosted back to the image I created right before beginning
the process (love the Ghost 2003). I start the Office 2000 install
process again, get to the error message, and armed with my SP4 CDROM
clicked on continue (or whatever), where it refused to recognize my
CDROM as acceptable. As you might expect, I am less than pleased.

OK, a little research on this Windows File Protection reveals a couple
of ways to disable it. Both are registry edits. One disables it for
one reboot, and one permanently. Thinking that it may be a useful
feature in the future, I disable it temporarily, reboot (again killing
the Office 2000 install partway through), and restart the install.
Loeth and beholdeth, the install completes fine – no errors, no pause
for the CDROM (which was inserted in the drive).

Again, not wanting some bastardized uncompleted Office 2k install on
my system I re-image back to the pre-install state. I make the
registry change to temporarily turn the Windows File Protection off,
reboot and restart the Office 2k install. What's this? I get the same
error message again. Blood pressure is up, invectives are flying. OK,
that's it. I re-image, use the registry editor to permanently kill the
Windows File Protection, reboot, check the registry to confirm the
kill entry is in place, and go to re-install Office 2k. Same error!!

OK, put on the thinking cap. I had one successful Office 2k install.
What was different about that attempt? One thing: I had attempted a
second install of Office 2k on the same image (no re-image between
attempts). To test this theory, I canceled the Office 2k install at
the error point, watched it ‘undo' whatever it had done, and restarted
the install process. Loeth and beholdeth again, the installation
process completed successfully (and partway through it started reading
the CDROM drive with no problem!).

This does not bode well for future software rollouts. Even though we
can theoretically disable this Windows File Protection service,
telling users ‘begin the installation process, wait for the error
message, cancel the install and restart it' is lame.

Needless to say, Microsoft is not on my A-list this week.

 

[Jace]

Windows File Protection is NOT a new feature in SP4.

It was a feature of Windows 2000 Gold, (pre-SP1).

When prompted for a Windows 2000 CD, put the Retail or OEM Win2k Pro CD-ROM
that was used to setup/image the system (regardless of the sp level of that
CD) and let Windows do its thing.

Windows should keep the files at the correct SP level automatically.

Hope this helps.

 

[Jace]

Windows File Protection is NOT a new feature in SP4.

It was a feature of Windows 2000 Gold, (pre-SP1).

When prompted for a Windows 2000 CD, put the Retail or OEM Win2k Pro CD-ROM
that was used to setup/image the system (regardless of the sp level of that
CD) and let Windows do its thing.

Windows should keep the files at the correct SP level automatically.

Hope this helps.

 

[Gerry Hickman]

Task at hand: Install Office 2000 SR-1 (the same distribution we used
for the Office 2000 rollout at our company).

I've put dozens of Office 2000 - SP1 over Win2k SP4 and have never seen
this, the only difference is that on my systems I didn't use Windows Update.

error message: "Windows File Protection: must copy files from CDROM of
SP4. Please insert SP4 disk in CDROM Drive."

I agree this is lame, it's not actually asking for the "SP4" CD, it's
asking for the "Windows 2000" CD - possibly with integrated SP4 - a big
difference.

This "feature" is fine for a stand-alone home computer, but not too cool
in a massive enterprise. Apart from anything else, it requires a UI, and
that in itself is lame.

 

[Jace]

In an Enterprise, one could extract the SP4 files, put them on a network
share and run the update.exe from the extracted files.

If the extracted files were left on the share, accessible to the
workstations, then, when the computer needed to use WFP, it could obtain the
files silently from the network location with no intervention from the end
user.

This happens when the files are retrievable from the 250MB cache of files
that is set up by default on a win2k/xp workstation during
installation/service pack upgrade. However, if the file is not in that
cache, then you are prompted for another source if that source is not
readily available, i.e. the CD sitting in the cd-rom drive, or the network
path available.

HTH

 

[Larry Serflaten]

I agree this is lame, it's not actually asking for the "SP4" CD, it's
asking for the "Windows 2000" CD - possibly with integrated SP4 - a big
difference.

This "feature" is fine for a stand-alone home computer, but not too cool
in a massive enterprise. Apart from anything else, it requires a UI, and
that in itself is lame.

How is it fine for the home user? That user probably downloaded the
SP from WindowsUpdate and has no CD to offer it!

LFS

 

[Gerry Hickman]

If the extracted files were left on the share, accessible to the
workstations, then, when the computer needed to use WFP, it could obtain the
files silently from the network location with no intervention from the end
user.

Yes, if that's the case, then it's very sensible. At my work it's on a
network share, and I've never had the WFP there.

I've had it at home, and it was annoying there was no option to browse
to my distribution folder, but now I think about it more, I did (in
fact) originally install the O/S from a bootable CD-ROM at home, so
maybe this is why.

I should have done an unattended from a FAT16 paratition and extended
it. This is what I plan to do for my next home build.

 

[Jon Martin]

I was able to test Jace's solution yesterday, and it worked as
advertised. (Thanks, Jace!) This is the obvious choice for deploying
SP4 in the enterprise. The trick is to insure that your users do not
update to SP4 on their own using Windows Update. Fortunately we have
had the Windows Update site blocked for about a year now, so we should
not see the problem I originally wrote about on our enterprise
workstations.

 

[Gerry Hickman]

Hi Jon,

Thanks for confirmation. I was obviously confused between my home and
work builds in my earlier post - sorry for any confusion.