Event ID 5 — File Screening Metadata Integrity
Applies To: Windows Server 2008
.jpg)
To enforce file screening, the file screening minifilter driver uses configuration information that is stored in a metadata file. If there is a problem with this metadata file, the file screening minifilter driver cannot attach to the volume, and users might be able to save unauthorized files.
Event Details
| Product: | Windows Operating System |
| ID: | 5 |
| Source: | datascrn |
| Version: | 6.0 |
| Symbolic Name: | DATA_SCREEN_MSG_UNKNOWN_METADATA_VERSION |
| Message: | The screening minifilter driver failed to attach to volume "%2 (%5)" because the minifilter metadata on the volume is the wrong version (version 0x%3 when version 0x%4 was expected). This is most likely caused by a driver upgrade followed by a restore of old metadata or by a metadata corruption. While the driver is detached file screening enforcement and management will be unavailable on the volume. Try to reinstall the driver or restore a newer version of your file screening configuration metadata. |
Resolve
Reattach the file screening minifilter driver
You have to manually reattach the file screening minifilter driver to the volume.
To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.
To reattach the file screening minifilter driver to the volume:
Open an elevated command prompt. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
Type fltmc attach datascrn volume**:**, where volume is the drive letter of the volume, and then press ENTER. For example:
fltmc attach datascrn c:
Verify
To verify that the metadata used by the file screening minifilter driver is correct, you must verify that the file screening minifilter driver is attached to the volume.
To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.
To verify that the file screening minifilter driver is attached to the volume:
- Open an elevated command prompt. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
- Type fltmc instances and press ENTER. The file screening minifilter driver is attached to the volume if there is a Datascrn instance listed for the volume.