0

We have recently experienced a spate a blue screens with some virtual machines. From BSOD dump analysis, courtesy of Microsoft, they have stated this is due to a corruption in the WinSXS directory.

Looking at the server disks (attached to working VMs) one thing of note is the the WinSXS\Backup folder for all 4 VMs is empty. My thinking behind this directory is that is would store previous versions of the files in WinSXS and restore from these if there is a failure. Does anyone know if this is the actual usage case for this directory? If so could having no files in this directory be part of the cause due to an unrecoverable boot failure? My google-fu for anything WinSXS related is mainly around how to use dism of disk cleanup to reduce the size.

  • The backup folder is used to get the basic Windows core functions up and running, when critical system files are corrupted. – magicandre1981 Jan 29 '16 at 16:07

1 Answers1

0

The usage is essentially correct, and not having any files in that folder would break one of the recovery options.

"Windows Resource Protection
To preserve the integrity of the many components involved in the boot process, as well as other critical Windows files, libraries, and applications, Windows implements a technology called Windows Resource Protection (WRP). WRP is implemented through access control lists (ACLs) that protect critical system files on the machine. It is also exposed through an API (located in %SystemRoot%\System32\Sfc.dll and %SystemRoot%\System32\Sfc_os.dll) that can be accessed by the Sfc.exe utility to manually check a file for corruption and restore it.

"WRP copies files that are needed to restart Windows to the cache directory located at %SystemRoot%\winsxs\Backup. Critical files that are not needed to restart Windows are not copied to the cache directory. The size of the cache directory and the list of files copied to the cache cannot be modified. To recover a file from the cache directory, you can use the System File Checker (Sfc.exe) tool, which can scan your system for modified protected files and restore them from a good copy."

Windows Internals, Sixth Edition, Chapter 13

See also: https://en.wikipedia.org/wiki/Windows_Resource_Protection

Greg Askew
  • 35,880
  • 5
  • 54
  • 82