Event ID 5 — File Screening Metadata Integrity

Updated: January 27, 2011

Applies To: Windows Server 2008

red

To enforce file screening, the file screening minifilter driver uses configuration information that is stored in a metadata file. If there is a problem with this metadata file, the file screening minifilter driver cannot attach to the volume, and users might be able to save unauthorized files.

Event Details

Product: Windows Operating System
ID: 5
Source: datascrn
Version: 6.0
Symbolic Name: DATA_SCREEN_MSG_UNKNOWN_METADATA_VERSION
Message: The screening minifilter driver failed to attach to volume "%2 (%5)" because the minifilter metadata on the volume is the wrong version (version 0x%3 when version 0x%4 was expected). This is most likely caused by a driver upgrade followed by a restore of old metadata or by a metadata corruption. While the driver is detached file screening enforcement and management will be unavailable on the volume. Try to reinstall the driver or restore a newer version of your file screening configuration metadata.

Resolve

Reattach the file screening minifilter driver

You have to manually reattach the file screening minifilter driver to the volume.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To reattach the file screening minifilter driver to the volume:

  1. Open an elevated command prompt. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Type fltmc attach datascrn volume:, where volume is the drive letter of the volume, and then press ENTER. For example:

    fltmc attach datascrn c:

Verify

To verify that the metadata used by the file screening minifilter driver is correct, you must verify that the file screening minifilter driver is attached to the volume.

To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.

To verify that the file screening minifilter driver is attached to the volume:

  1. Open an elevated command prompt. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
  2. Type fltmc instances and press ENTER. The file screening minifilter driver is attached to the volume if there is a Datascrn instance listed for the volume.

Related Management Information

File Screening Metadata Integrity

File Services

Community Additions

ADD
Show: