How to Disable Windows System File Protection (SFC) in Windows XP

Posted on: August 13th, 2008

Disclaimer: the procedures below are only for advanced Windows users. These procedures are not approved by Microsoft and you should try it at your own risk. You should always back your system up before attempting to modify core system features like System File Protection.

I found a simple and very effective way to disable Windows XP’s system file protection.

The key file responsible for protecting the system files is: system32\sfc_os.dll. It is loaded in by winlogon.exe and is hardwired into it so no registry editing will be able to disable it.

You can delete the file using a Live XP CD (BartPE or UBCD4win) but then you will get an errormessage each time Windows starts up. I went around that. First I renamed the file so I could get back to it if needed. Then I searched for the smallest .dll file in the system32 folder. That happened to be the lz32.dll file with the length of 2,560 bytes. So I copied that file as sfc_os.dll. After this: no complaint from the system, no protection either. I checked and lz32.dll doesn’t stay in the memory – it terminates shortly after it’s invoked.

An addition to the above: disabling the sfc_os.dll file causes the msiexec.exe to crash. Which means you won’t be able to install/uninstall software which uses the MSI installer. Here’s another solution if you want to keep that part of the system functioning, however it will not eliminate the SFC warning messages when system files are changed:
- Boot into Safe Mode, or use a live CD. Empty out the system32\dllcache folder. Change the security settings on that folder by disabling inheritance and completely clearing out the ACL list. This effectively blocks SFC from restoring/saving system files. It will leave intact other functionality as far as I could see.

Laszlo

Did you find this information useful?
Please consider donating.

You can leave a comment for the above article. Comments will not show up automatically but will be reviewed and incorporated into the article if they contain useful information.

cforms contact form by delicious:days