Fsutil Behavior Query Message After Windows Loads

webbj · 20 Jan 2017

Some where around Tuesday, I started receiving a pop up after Windows loaded asking how I wanted to open a file. This occurs every time PC is either initially started or there's a restart. As I selected no file to open, I was concerned and ran antivirus. Nothing was found. The next time I received the pop up I opened in Notepad and found the below mesage. I did a search but things I found weren't straight forward enough for me to understand what this is and how to solve the problem if it's a problem. Any suggestion would be helpful. Getting tired of the pop up and if there's problem I need to deal with it so nothing happens especially considering NTFS is listed in the texted. Last thing I need is my file system having problems. Thanks

Usage : fsutil behavior query <option>

<option>

AllowExtChar
BugcheckOnCorrupt
Disable8dot3 [<Volume Path>]
DisableCompression
DisableCompressionLimit
DisableDeleteNotify[NTFS|ReFS]
DisableEncryption
DisableFileMetadataOptimization
DisableLastAccess
DisableSpotCorruptionHandling
EncryptPagingFile
MemoryUsage
MftZone
QuotaNotify
SymlinkEvaluation
DisableWriteAutoTiering [<Volume Path>]
DisableTxf [<Volume Path>]

Please use "fsutil 8dot3name query /?" for more information.

For DisableDeleteNotify if neither "NTFS" nor "ReFS" is specified, both values are shown.

dalchina · 20 Jan 2017

Hi, this is what you get if you type
fsutil behavior query
at a command prompt - it's explanatory text about how to use the command as you've probably realised.

1. Easy options:
Do you have any system restore points prior to when this started to occur?
or
Do you have a suitable disk image you could restore?
(We strongly recommend the routine use of disk imaging which can mean you can resolve issues without technical assistance).

2. Lacking the above:
What happens
a. in Safe Mode
b. after a clean boot

I.e. does this originate from something starting up.

3. As a matter of routine, and because the use of fsutil is often related to file system structure, please do this:
From an admin command prompt
[Windows key + X, click command prompt (admin)]
chkdsk C: /F
Your PC will need to restart.
Make sure the result is clear or fixed- else do not proceed.
Post back the result, which you can get after a restart as follows:
How do I see the results of a CHKDSK that ran on boot? - Ask Leo!

Repeat for any other partitions.

webbj · 20 Jan 2017

I do have a restore point prior to first seeing this. Will try the restore but question on third point. My assumption is that this is a Windows situation. I ask because I'm running multiple drives. Windows is on its own drive and all programs/apps are on a different drive. I assume if I run restore, points 2 (I'm sure this one isn't based on your directions) or 3 are not needed?

My question is how and why did I receive this in the first place. Mainly for knowledge so I can avoid I happening again. Thanks

dalchina · 20 Jan 2017

We don't know which drive/partition this might be related to.

I have no idea why you're getting this.. hence initial step 2. Of course it might be possible to find out from a sysinternals procmon trace, but that's hard.

Might be related to chkdsk being triggered or system maintenance, but that's just a guess.

webbj · 20 Jan 2017

Initially, the restore worked. System updated Windows as there were updates since last restore point as well as antivirus.

The problem is back. As I play games, one of my group requirements is a communication program called discord. Can be opened in browser but for press to talk, the installed program is preferred. I downloaded and tied to install the program. The last time it did install but this time there was an error and I restarted after clean temp folder. That's when the error came back. So, I'm assuming it's the discord program.

FYI, step two, no pop up for error. I'll try step three before restoring.

dalchina · 21 Jan 2017

Ok, if no issue after a clean boot, what you need to do is progressively enable programs until you identify the source.