Detect Windows Automatic Updates

Question

I have software that replaces core OS files. Problem is that Microsoft updates replace those files, rendering the program inoperative. How can I detect file replacement at boot time, due to automatic updates?

My idea is a registry watch on some key, what key? Any other ideas?

score 0 · Accepted Answer · answered Jun 15 '11 at 05:58

0

Boot-time file replacements are done by smss.exe by referring PendingFileRenameOperations value under HKLM\SYSTEM\CurrentControlSet\Control\Session Manager key. Also, AllowProtectedRenames should be set to 1 if files that are protected by Windows File Protection are going to be moved/deleted. Few resources that might be helpful:
http://msdn.microsoft.com/en-us/library/aa365240.aspx
http://www.techbytes.ca/techbyte101.html

answered Jun 15 '11 at 05:58

swatkat

4,785
1
23
17

I am not sure if `AllowProtectedRenames` is needed on Vista and above. Because there being no WFP. – unixman83 Jun 28 '11 at 02:14

Detect Windows Automatic Updates

1 Answers1