Windows 10: File System Filter 'wcifs' EVENT ID 4

Unfortunately not, least not for me. Even safe mode won't work on restore. I've had to make a system image for now, that seems to work, even though throws the filter manager issue up again in event view. I've successfully restored off image as a test.

 

Hi,


To verify that the file screening minifilter driver is working properly, you must verify that it is attached to the volume.
To perform this procedure, you must have membership in Administrators, or you must have been delegated the appropriate authority.
To verify that the file screening minifilter driver is attached to the volume:
1.Open an elevated command prompt. Click Start, point to All Programs, click Accessories, right-click Command Prompt, and then click Run as administrator.
2.Type fltmc instances and press ENTER. The file screening minifilter driver is attached to the volume if there is a Datascrn instance listed for the volume.

Cheers, *Wink

 

@fdegrove

In your output theres no wcifs instance, and mine looks exactly the same as Conm3.

 

Hi all!

Same problem here on EVERY system that is running here. Including some clean virtual machines even. The troubles seem to have started after a series of obligatory MS-app updates some days ago.

It happens during making system restore points, system images and file back-ups. Basically everything that makes use of VSS. This sounds big. It means that there is no way anymore to restore a Windows 10 system to a former state suddenly. Neither by a system restore nor - probably - by restoring an image. Red somewhere else that also software like True image is affected. Also file backup tools seem to work unreliable, see the error here too appearing while running backups. Doesn't sound good at all. If something goes wrong now a clean reinstall will be needed :-( We decided to leave some systems off here until it's clear what is going on. Hopefully Microsoft is aware of this serious issue.


Greetz,

Pete.

 

Hey everyone, I just signed up to chime in that the two machines I am running Windows 10 Pro on have been kicking out this exact warning for the last few days to a week. I'm hoping it's something Microsoft can fix, but I'm looking into how to fix it myself, if possible.

 

Hi Corsa1, it does seem to be on Microsoft's end. I'd save yourself time and just hang on for them, your choice of course. I must of tried everything so in the end i did a complete clean reinstall and the issue is still there. Spent best part of a week on it but I'm now leaving it to MS.

Cheers for now

 

Afternoon all ... just an FYI,

I can create a restore point, says it created successful (event id 4 'wcifs') and on system restore I'm getting the ... System Restore fails: AppxStaging %ProgramFiles%\WindowsApp 0x80070091.

Tried the fix here in the forum for 0x80070091, with no luck. Seems I can only do a restore from Safe Mode/Recovery.

Tried creating restore point and doing system restore, with 'wcifs filter' unloaded/stopped, but still failed with the 0x80070091. So it doesn't seem the (event id 4 'wcifs') is affecting system restore, at least in my case.

NOTE: I haven't seen any adverse affects from unloading/stopping the 'wcifs filter'.
If anyone else has the same (event id 4 'wcifs') and wants to do some testing *Smile

To stop (event id 4 'wcifs') from showing up.
1. Open a command prompt as administrator
2. fltmc filters and fltmc instances - to see if wcifs is listed
3. sc stop wcifs - you should be able to create a restore point now without (event id 4 'wcifs') showing up.
4. sc config wcifs start= demand - otherwise (event id 4 'wcifs') will show up on reboot.

Note: edited for brevity....

>fltmc filters
Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
wcifs 1 189900 0

>fltmc instances
Filter Volume Name Altitude Instance Name Frame SprtFtrs VlStatus
-------------------- ------------------------------------- ------------ ---------------------- ----- -------- --------
wcifs C: 189900 wcifs Instance 0 00000000

 

Hi Eagle,

I've always been able to create a restore point just actually trying to restore from it always fails albeit safe mode didn't work for me tbh either.

 

HI!

re-installing is indeed useless. The pushed MS updates immediately create the problem again... :-/

 

Hi,

If that were so then it would affect everyone. It does not.
First step to take is to make sure the system files are healthy.
I passed on the info and provided the tools but can't do the actual work for you.


Best, *Wink

 

Hi!

This is not working here. Or better: its just a confirmation of what is going on. I got many friends an colleagues to check the error and they are affected. Also, the last week the amount of complaints about a non functioning system restore in Windows 10 are exploding. I checked it on a clean(!) Windows 10 virtual machine: same symptoms after the most recent updates. So maybe all people that did receive the recent app-updates are affected indeed. Only the ones who somehow switched off automatic app updates escaped it.

Besides (and that is the core of the problem) 90% of the end users will not repair system faults unnoticedly introduced after an app update via the command prompt. Even worse is that the tools to generate a restore point, make backups with or system images do not show an error. The problem is discovered only after a system crash when people try to recover from a backup or restore point. That fails, which means it is too late to do anything about it.

But any help of course is welcome and when your link works for some: great & thanks for the info!!! *Thumbs

*** EDIT *** Just realized that the link you gave is actually meant to solve another type of Event ID 4. What we are talking about here is Event ID 4 FilterManager in combination with WCIFS as the trigger. And not File Screening Minifilter Driver Integrity...

Pete.

 

Hi!

Thanks for the info!

But this is not a permanent solution, is it? And does this procedure create reliable and working restore points, file back-ups and/or system images?

And I also don't know if the FilterManager/wcifs event ID is a cause or a result of system restore fails. The thing is: something happened somewhere after about February 16th that broke down something in Windows. The results are possible unreliable backups, images and restore points. We can all try to repair and figure out things ourselves. But first we have to know what happened. The error appears also on completely clean installed systems. That is worrying.

And: how can a series of app updates break down wcifs?

 

No that is not a fix, as the only thing it does is suppress the (event id 4 'wcifs'). I didn't realize I had the system restore issue, until I started looking into the (Event id 4 'wcifs') issue and tried to do a system restore... lol. For all I know the two are not related at all, but I figured I had start some where.

Update and no this did NOT fix the system restore *Sad and I'm NOT recommending this as fix for (event id 4 'wcifs'), even tho it got rid of the (event id 4 'wcifs') for me.

I took a look thru the 'c:\system volume information' folder. and found a wcifs.md file (not clue what it does, as it just had a single ascii character in it. So, seeing how there is a SystemRestore folder is in there as well, I deleted the whole 'c:\system volume information' folder and let windows rebuild it. Set wcifs back to auto start. rebooted and created a restore point. No (event id 4 'wcfis'), but system restore still fails.

The System Restore fails: AppxStaging %ProgramFiles%\WindowsApp 0x80070091 (directory is not empty) may be an app locking a file or a permission issue but, it's just a guess. Forgive me for stating the obvious, but whichever app it is, was updated in the last couple of weeks and all of us having the issue got it... *Sad

Note: I have run chkdsk, sfc, dism, and they reported no issues.

 

Looks like MS failed big this time *Sad. System restore not working is only one of the symptoms. The FilterManager/wcifs-warning appears also when file-backup software is used or system images are made. An essential part of Windows broke down completely and most people will only discover when it is too late. What a mess.

 

Seeing the same issue on all four of my PCs. If this impacts the successful use of VSS to make backup images, then I suggest that if your using Macrium that you make your backup images using the Macrium USB stick and not from within Windows. That method does not utilize VSS and hopefully would be successful.