The Windows File Protection subsystem runs inside the winlogon.exe process and supports one RPC service, available on the following endpoints:
Y:\>ifids -p ncalrpc -e SfcApi serveur Interfaces: 9 [...] 83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0 [...]
Table 4.109. sfcapi operations
| Interface | Operation number | Operation name |
|---|---|---|
| 83da7c00-e84f-11d2-9807-00c04f8ec850 v2.0: sfcapi | ||
| 0x00 | SfcSrv_GetNextProtectedFile | |
| 0x01 | SfcSrv_IsFileProtected | |
| 0x02 | SfcSrv_FileException | |
| 0x03 | SfcSrv_InitiateScan | |
| 0x04 | SfcSrv_PurgeCache | |
| 0x05 | SfcSrv_SetCacheSize | |
| 0x06 | SfcSrv_SetDisable | |
| 0x07 | SfcSrv_InstallProtectedFiles |