Windows File Protection problem

[imported_JFG]

Every 3 weeks or so, I have 4 users who get the following event which prevents them from logging in.
Event Type: Error
Event Source: Windows Product Activation
Event Category: None
Event ID: 1000
Date: 3/7/2005
Time: 6:27:19 AM
User: N/A
Computer: name
Description:
An error occurred while the wizard was checking the current Windows product license. Error Code: 0x80070002


I copy back the oembios.dat & secupt.dat files remotely & they can get in. Once their back in, the event logs fill up with these events:
Event Type: Information
Event Source: Windows File Protection
Event Category: None
Event ID: 64002
Date: 3/5/2005
Time: 3:36:44 PM
User: N/A
Computer: name
Description:
File replacement was attempted on the protected system file c:\windows\system32\oembios.dat. This file was restored to the original version to maintain system stability. The file version of the system file is 0.0.0.1.
It seems just a matter of time before it happens again. Anyone seen this before & know a way to prevent this?? SFC scan didn't work

Thanks

 

[imported_JFG]

anyone seen it before?

 

[imported_JFG]

anyone??

 

[mikecel79]

This may help.

Linky

 

[imported_JFG]

Thanks 79. Yeah, I've been copying those 2 files back to the system32 directory & the users are able to log on again. The problem/issue is that it has happened again for 3 users anywhere from 2-5 weeks later. I'm trying to find the root of what's causing it. I've checked for malware etc.. & have ran a SFC. Maybe I'll reapply SP2

 

[blizz]

Are they Dell computers?
You could try this

 

[imported_JFG]

Thanks.. I saw the KB article and unfortunately it doesn't apply.

 

[imported_JFG]

Found the issue causing the problem. We used out management software to push out client fax software. For some reason the fax server smtp gateway service got installed for certain users. This particular software requires specific license files. I disabled the service & the events stopped.