Windows File Protection

The file sfc_os.dll is responsible for the Windows File Protection. When you try to replace a protected file/folder, you'll see one of these prompts:

Unattended XPCD


If you really meant to replace the file, then a simply press of Cancel solves the problem. What if you didn't want to take the time to press Cancel or the protected file is already in the DLLCACHE folder, then read on to disable WFP.

If you're one of those people that want a prepatched version, scroll to the bottom of the page for your files.

Hacking the file

For this, and to avoid you having to find the sfc_os.dll file for your specific version of Windows, this page will walk you through it using nLite.



If you wish to Enable WFP

Say you just wanted the ability to disable WFP, but still want the option to enable it, then it's as simple as setting a registry key and restarting the system.

The key in question is called SFCDisable, and is located at
HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon

Change the value to 0x00000000 to enable and to 0xFFFFFF9D to disable. The following are prewritten REG files that you could apply to your RegTweaks file, or import on their own later.

;Re-enable WFP
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"SFCDisable"=dword:00000000

;Disable WFP
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"SFCDisable"=dword:FFFFFF9D


Final Notes

As you may notice, there are many more options within nLite that you can use. In fact, you could do the TCP patch, the WFP patch, and the UXtheme patch all in one step. This guide just breaks it up.


Prepatched Files

Just select your operating system, download and replace the current file in your I386 directory, and then apply one of the above registry tweaks.

Windows XP RTM | Windows XP SP1 | Windows XP SP2 | Windows Server 2003