A reg tweak for shutting off WFP, with no DLL hacking

[fdv]

Hi all,

I don't think I posted this here and really, it does belong here.

I discovered this accidentally in Windows 2000.

If you want WFP shut off, just specify invalid paths in the registry, like so:

HKLM,"SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon","SFCDllCacheDir",,"z:"

HKLM,"SOFTWARE\Policies\Microsoft\Windows NT\Windows File Protection","SFCDllCacheDir",,"z:"

Make your own INF file, etc etc etc. If you inset this into a HIVE file*, it will work at boot time.

I wish UNC paths could be used, but MS says they don't work (and they don't, I've tried)

*You must do the search-and-replace ,_x, to ,, (that's replace comma underscore ecks comma with comma comma) in LAYOUT.INF and save it, so that Windows doesn't throw an error... the _x tells Windows setup to check the filesize against the filesize number in layout. If you just remove the _x from the HIVE lines, you have still changed the size of layout itself, so you'd have to change that line too, so just replace every ,_x, with ,, and save yourself the work.

[GrofLuigi]

Hi fdv,

I appreciate your work very much. I saw this when you posted it, and I have some comments about it:

1. I would be uncomfortable to have nonexisting path in the registry because I use many registry cleaners. And even without them, somehow it doesn't seem quite "right"... Would it be possible to modify it to something like @SYS:DoesNotExist (as seen in that autorun disabling registry hack)?

2. I haven't tried it yet (because nLite did a great job on SFC here), but does it shut down SFC completely? For example, if you delete sfcfiles.dll (and/or similar files) there is an event log entry on every boot saying "SFC is not active on this system". That would be the perfect solution if sfc.dll (or sfcfiles.dll, I don't remember any more) wasn't referenced in other core system dlls and needed for many things.

I'm talking about live systems above.

About the second part (*), I've seen that also in some of (your?) posts before, and I'm very enthusiastic about its potential application. So some questions about that (as I understand, that's replacing ,_x, with ,, to disable filesize matching requirement):

3. To which files (.inf's) does it apply? Only layout.inf? (OK I'm slow )

4. Does it apply during first-time setup only or every time a device (inf) is installed?

5. Can it be done on a live system (edit inside %windir%\inf)?

6. Is it independent from SFC?

7. As I mostly use nLite, can a finished nLite folder be pre/postprocessed?

8. In which OSes does it work?

So many questions... And as you can see, I'm not very skilled in this .inf editing...

Thanks.

GL

[fdv]

1. Not sure. Try it.

You could point to SYSTEM instead of Z:, and that would also get by reg cleaners.

2. It does disable SFC completely. In a live system.

3. Second part: this applies to LAYOUT, yes. I personally did it ALSO to TXTSETUP.

4. First time setup only.

5. A live system, no, because Windows only uses LAYOUT one time in its life: during setup.

6. Yes, it is totally independent from SFC.

7. A finished nLited folder can indeed be both pre- and post-processed.

Tip: did you know that TXTSETUP and LAYOUT can use the SAME file list? After you have run nLite, you will see that the file list under [sourceDisksFiles] in TXTSETUP is changed. You can copy this entire list and paste it right over the same list in LAYOUT.

I will say this differently: Windows copies files two times during setup. Once with LAYOUT and once with TXTSETUP.

nLite only changes TXTSETUP. If you put the same [sourceDisksFiles] list in both places, setup will go much faster because LAYOUT will not bother copying files to the disk that TXTSETUP won't even use.

8. Windows 2000 and XP are the ones I know of. Never tried it in NT4.

[GrofLuigi]

Thank you for taking time to answer my stupid questions.

GL

[woody.cool]

8. Windows 2000 and XP are the ones I know of. Never tried it in NT4.

Windows NT4 (and below) doesn't have WFP. Only Windows 2000 and later.

[Kelsenellenelvian]

1. Not sure. Try it.

You could point to SYSTEM instead of Z:, and that would also get by reg cleaners.

2. It does disable SFC completely. In a live system.

3. Second part: this applies to LAYOUT, yes. I personally did it ALSO to TXTSETUP.

4. First time setup only.

5. A live system, no, because Windows only uses LAYOUT one time in its life: during setup.

6. Yes, it is totally independent from SFC.

7. A finished nLited folder can indeed be both pre- and post-processed.

Tip: did you know that TXTSETUP and LAYOUT can use the SAME file list? After you have run nLite, you will see that the file list under [sourceDisksFiles] in TXTSETUP is changed. You can copy this entire list and paste it right over the same list in LAYOUT.

I will say this differently: Windows copies files two times during setup. Once with LAYOUT and once with TXTSETUP.

nLite only changes TXTSETUP. If you put the same [sourceDisksFiles] list in both places, setup will go much faster because LAYOUT will not bother copying files to the disk that TXTSETUP won't even use.

8. Windows 2000 and XP are the ones I know of. Never tried it in NT4.

OMG I am so trying this right now!

[jaclaz]

@fdv

JFYI:

http://www.codeproject.com/KB/system/SetSfcFileException.aspx

Maybe useful for something.

jaclaz