Event ID 9 — File Screening Metadata Integrity
Applies To: Windows Server 2008 R2
.jpg)
To enforce file screening, the file screening minifilter driver uses configuration information that is stored in a metadata file. If there is a problem with this metadata file, the file screening minifilter driver cannot attach to the volume, and users might be able to save unauthorized files.
Event Details
| Product: | Windows Operating System |
| ID: | 9 |
| Source: | datascrn |
| Version: | 6.1 |
| Symbolic Name: | DATA_SCREEN_MSG_METADATA_RENAME_ERROR |
| Message: | An unexpected error occurred while renaming metadata entry for directory "%4" on volume "%2 (%5)". Error status: %3 This may have resulted in incorrect file screening configuration or a blocked file being stored. It is recommended that you review the file screening configuration on the volume for misconfigured or missing entries using the management tools. |
Resolve
Fix file screening configuration manually or restore the configuration from backup
When the file screening minifilter driver detects an invalid file screening configuration record in the metadata file, it automatically deletes it.You can review the current file screening configuration and try to determine what has changed. If you cannot determine what has changed, or if you are unable to manually recover from the changes, then restore the file screening information from a recent backup.
Review and fix file screening configuration manually
To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.
To review the current file screening configuration and manually fix any changes:
- Open File Server Resource Manager. Click Start, point to All Programs, click Administrative Tools, and then click File Server Resource Manager.
- To list all currently configured file screens, in the console tree, under File Screening Management, click File Screens.
- Review the currently configured file screens and look for any configuration changes. To see the properties of a specific file screen, right-click that file screen and then click Edit File Screen Properties.
- Determine if a file screen has been deleted. Click Filter to filter file screens by the volume or folder that they apply to. Recreate any file screens that have been deleted.
- If you cannot determine what has changed, or if you are unable to manually recover from the changes, then restore the file screening information from a recent backup.
Restore file screening configuration from backup
Use your backup application to restore the information in the System Volume Information folder of each volume that is managed by File Server Resource Manager. If you are unable to restore the volume configuration from a recent backup, or if restoring the volume configuration does not solve the problem, then the file screening configuration files that are stored in the System Volume Information folder of the volumes managed by File Server Resource Manager need to be deleted and created again.
Caution: Deleting the file screening configuration files that are stored in the System Volume Information folder of the volumes managed by File Server Resource Manager is a complex troubleshooting procedure that could jeopardize the integrity of other important configuration files stored in these folders. For this reason, this troubleshooting task requires assistance from Microsoft Customer Support Services (CSS). For information about how to contact CSS, see https://go.microsoft.com/fwlink/?LinkId=89446.
Verify
To verify that the metadata used by the file screening minifilter driver is correct, you must verify that the file screening minifilter driver is attached to the volume.
To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.
To verify that the file screening minifilter driver is attached to the volume:
- Open an elevated command prompt. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
- Type fltmc instances and press ENTER. The file screening minifilter driver is attached to the volume if there is a Datascrn instance listed for the volume.