4.11.28. Windows File Protection

The Windows File Protection subsystem runs inside the winlogon.exe process and supports one RPC service, available on the following endpoints:

Y:\>ifids -p ncalrpc -e SfcApi serveur
Interfaces: 9

[...]

  83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0

[...]

Table 4.109. sfcapi operations

InterfaceOperation numberOperation name
83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0: sfcapi  
 0x00SfcSrv_GetNextProtectedFile
 0x01SfcSrv_IsFileProtected
 0x02SfcSrv_FileException
 0x03SfcSrv_InitiateScan
 0x04SfcSrv_PurgeCache
 0x05SfcSrv_SetCacheSize
 0x06SfcSrv_SetDisable
 0x07SfcSrv_InstallProtectedFiles