imported>GreenC bot: Reformat 1 archive link. Wayback Medic 2.5 per WP:URLREQ#blogs.msdn.com

2024-07-26T17:50:33Z

Reformat 1 archive link. Wayback Medic 2.5 per WP:URLREQ#blogs.msdn.com

New page

{{Short description|File protection software}}
{{More citations needed|date=August 2022}}

'''Windows Resource Protection''' is a feature first introduced in [[Windows Vista]] and [[Windows Server 2008]]. It is available in all subsequent [[Microsoft Windows|Windows operating systems]], and replaces [[Windows File Protection]]. Windows Resource Protection prevents the replacement of critical system files, [[Windows Registry|registry]] keys and folders. Protecting these resources prevents system crashes.<ref>{{Cite web |title=About Windows Resource Protection - Microsoft Docs |url=https://docs.microsoft.com/en-us/windows/win32/wfp/about-windows-file-protection }}</ref> The way it protects [[Resource (Windows)|resources]] differs entirely from the method used by Windows File Protection. {{Citation needed|date=August 2022}}

== Overview ==
Windows Resource Protection (WRP) works by registering for notification of file changes in [[Winlogon]].{{Disputed inline|File change notification usage|date=November 2017}} If any changes are detected to a protected system file, the modified file is restored from a cached copy located in {{mono|%WinDir%\WinSxS\Backup}}.<ref name=":0">{{Cite web |title=Protected Resource List - Microsoft Docs |url=https://docs.microsoft.com/en-us/windows/win32/wfp/protected-file-list }}</ref> Windows Resource Protection works by setting discretionary access control lists (DACLs) and [[access control list]]s (ACLs) defined for protected resources. Permission for full access to modify WRP-protected resources is restricted to the processes using the ''Windows Modules Installer service'' (TrustedInstaller.exe). Administrators no longer have full rights to system files; they have to use the ''SetupAPI'' or take ownership of the resource and add the appropriate Access Control Entries (ACEs) to modify or replace it. The TrustedInstaller account is used to secure core operating system files and [[Windows Registry|registry]] keys.

== Protected resources ==
Windows Resource Protection protects a large number of file types:
<pre>
*.acm *.ade *.adp *.app *.asa *.asp *.aspx *.ax *.bas *.bat *.bin *.cer *.chm *.clb *.cmd
*.cnt *.cnv *.com *.cpl *.cpx *.crt *.csh *.dll *.drv *.dtd *.exe *.fxp *.grp *.h1s *.hlp
*.hta *.ime *.inf *.ins *.isp *.its *.js *.jse *.ksh *.lnk *.mad *.maf *.mag *.mam *.man
*.maq *.mar *.mas *.mat *.mau *.mav *.maw *.mda *.mdb *.mde *.mdt *.mdw *.mdz *.msc *.msi
*.msp *.mst *.mui *.nls *.ocx *.ops *.pal *.pcd *.pif *.prf *.prg *.pst *.reg *.scf *.scr
*.sct *.shb *.shs *.sys *.tlb *.tsp *.url *.vb *.vbe *.vbs *.vsmacros *.vss *.vst *.vsw *.ws
*.wsc *.wsf *.wsh *.xsd *.xsl
</pre>
WRP also protects several critical folders. A folder containing only WRP-protected files may be locked so that only the TrustedInstaller user is able to create files or subfolders in the folder. A folder may be partially locked to enable administrators to create files and subfolders in the folder. Essential [[Windows Registry|registry]] keys installed by Windows Vista are also protected. If a key is protected by WRP, all its sub-keys and values can be protected.

WRP copies only those files that are needed to restart Windows to the cache directory located at {{mono|%WinDir%\WinSxS\Backup}}. Critical files that are not needed to restart Windows are not copied to the cache directory, unlike Windows File Protection which cached the entire set of protected file types in the ''Dllcache'' folder. The size of the cache directory and the list of files copied to cache cannot be modified.<ref name=":0" />

Windows Resource Protection applies stricter measures to protect files. As a result, Windows File Protection is not available under Windows Vista. In order to replace any single protected file, Windows File Protection had to be disabled completely; Windows Resource Protection works on a per-item basis by setting ACLs. Therefore, by taking ownership of any single item, that particular item can be replaced, while other items remain protected.{{Citation needed|date=August 2022}}

[[System File Checker]] is also integrated with WRP.<ref>{{Cite web |title=Description of System File Checker - Microsoft Docs |url=https://docs.microsoft.com/en-us/troubleshoot/windows-server/deployment/system-file-checker }}</ref> Under Windows Vista, Sfc.exe can be used to check specific folder paths, including the Windows folder and the boot folder.

== Resource replacement methods ==
In Windows Vista and Server 2008, full access to Windows Resource Protection is restricted to the TrustedInstaller user. The Windows Modules Installer service can replace resources using the following methods:

* Installing Windows [[Service pack|Service Packs]]<ref>{{Cite web |title=Service Pack and Update Center - Microsoft Support |url=https://support.microsoft.com/en-us/windows/service-pack-and-update-center-92bb1064-cf3b-0b94-7c57-331f7b7db3c6#ID0EBBD=Windows_7 }}</ref>
* Installing Windows Updates and hotfixes
* Performing operating system upgrades

An error message is generated if applications attempt to replace a WRP resource using different methods. In these cases, the applications or installers are denied access to the resource. <ref>{{Cite web |title=Supported Resource Replacement Mechanisms - Microsoft Docs |url=https://docs.microsoft.com/en-us/windows/win32/wfp/supported-file-replacement-mechanisms}}</ref>

== See also ==
* [[Windows File Protection]]
* [[System File Checker]]
* [[Access Control List]]
* [[Security Identifier]]

== References ==
{{reflist}}

== External links ==
* [https://web.archive.org/web/20070603100917/http://blogs.msdn.com/cjacks/archive/2007/04/20/windows-resource-protection-wrp-and-activex-control-installation-on-windows-vista.aspx Evolving the Software Organism - MSDN Blogs, Chris Jackson (Archived from the original)]

{{Windows Components}}

[[Category:Windows administration]]
[[Category:Windows components]]
[[Category:Windows Vista]]

Windows Resource Protection - Revision history

imported>GreenC bot: Reformat 1 archive link. Wayback Medic 2.5 per WP:URLREQ#blogs.msdn.com