File System Filter 'wcifs' EVENT ID 4

Afternoon all ... just an FYI,

I can create a restore point, says it created successful (event id 4 'wcifs') and on system restore I'm getting the ... System Restore fails: AppxStaging %ProgramFiles%\WindowsApp 0x80070091.

Tried the fix here in the forum for 0x80070091, with no luck. Seems I can only do a restore from Safe Mode/Recovery.

Tried creating restore point and doing system restore, with 'wcifs filter' unloaded/stopped, but still failed with the 0x80070091. So it doesn't seem the (event id 4 'wcifs') is affecting system restore, at least in my case.

NOTE: I haven't seen any adverse affects from unloading/stopping the 'wcifs filter'.
If anyone else has the same (event id 4 'wcifs') and wants to do some testing :)

To stop (event id 4 'wcifs') from showing up.
1. Open a command prompt as administrator
2. fltmc filters and fltmc instances - to see if wcifs is listed
3. sc stop wcifs - you should be able to create a restore point now without (event id 4 'wcifs') showing up.
4. sc config wcifs start= demand - otherwise (event id 4 'wcifs') will show up on reboot.

Note: edited for brevity....

>fltmc filters
Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
wcifs 1 189900 0

>fltmc instances
Filter Volume Name Altitude Instance Name Frame SprtFtrs VlStatus
-------------------- ------------------------------------- ------------ ---------------------- ----- -------- --------
wcifs C: 189900 wcifs Instance 0 00000000

Hi Eagle,

I've always been able to create a restore point just actually trying to restore from it always fails albeit safe mode didn't work for me tbh either.

HI!

re-installing is indeed useless. The pushed MS updates immediately create the problem again... :-/

Conm3 said:

Hi Corsa1, it does seem to be on Microsoft's end. I'd save yourself time and just hang on for them, your choice of course. I must of tried everything so in the end i did a complete clean reinstall and the issue is still there. Spent best part of a week on it but I'm now leaving it to MS.

Cheers for now

Hi,

Win10usr said:

HI!

re-installing is indeed useless. The pushed MS updates immediately create the problem again... :-/

If that were so then it would affect everyone. It does not.
First step to take is to make sure the system files are healthy.
I passed on the info and provided the tools but can't do the actual work for you.


Best,

Hi!

This is not working here. Or better: its just a confirmation of what is going on. I got many friends an colleagues to check the error and they are affected. Also, the last week the amount of complaints about a non functioning system restore in Windows 10 are exploding. I checked it on a clean(!) Windows 10 virtual machine: same symptoms after the most recent updates. So maybe all people that did receive the recent app-updates are affected indeed. Only the ones who somehow switched off automatic app updates escaped it.

Besides (and that is the core of the problem) 90% of the end users will not repair system faults unnoticedly introduced after an app update via the command prompt. Even worse is that the tools to generate a restore point, make backups with or system images do not show an error. The problem is discovered only after a system crash when people try to recover from a backup or restore point. That fails, which means it is too late to do anything about it.

But any help of course is welcome and when your link works for some: great & thanks for the info!!!

*** EDIT *** Just realized that the link you gave is actually meant to solve another type of Event ID 4. What we are talking about here is Event ID 4 FilterManager in combination with WCIFS as the trigger. And not File Screening Minifilter Driver Integrity...

Pete.

fdegrove said:

Hi,



If that were so then it would affect everyone. It does not.
First step to take is to make sure the system files are healthy.
I passed on the info and provided the tools but can't do the actual work for you.


Best,

Hi!

Thanks for the info!

But this is not a permanent solution, is it? And does this procedure create reliable and working restore points, file back-ups and/or system images?

And I also don't know if the FilterManager/wcifs event ID is a cause or a result of system restore fails. The thing is: something happened somewhere after about February 16th that broke down something in Windows. The results are possible unreliable backups, images and restore points. We can all try to repair and figure out things ourselves. But first we have to know what happened. The error appears also on completely clean installed systems. That is worrying.

And: how can a series of app updates break down wcifs?

Eagle51 said:

Afternoon all ... just an FYI,

I can create a restore point, says it created successful (event id 4 'wcifs') and on system restore I'm getting the ... System Restore fails: AppxStaging %ProgramFiles%\WindowsApp 0x80070091.

Tried the fix here in the forum for 0x80070091, with no luck. Seems I can only do a restore from Safe Mode/Recovery.

Tried creating restore point and doing system restore, with 'wcifs filter' unloaded/stopped, but still failed with the 0x80070091. So it doesn't seem the (event id 4 'wcifs') is affecting system restore, at least in my case.

NOTE: I haven't seen any adverse affects from unloading/stopping the 'wcifs filter'.
If anyone else has the same (event id 4 'wcifs') and wants to do some testing :)

To stop (event id 4 'wcifs') from showing up.
1. Open a command prompt as administrator
2. fltmc filters and fltmc instances - to see if wcifs is listed
3. sc stop wcifs - you should be able to create a restore point now without (event id 4 'wcifs') showing up.
4. sc config wcifs start= demand - otherwise (event id 4 'wcifs') will show up on reboot.

Note: edited for brevity....

>fltmc filters
Filter Name Num Instances Altitude Frame
------------------------------ ------------- ------------ -----
wcifs 1 189900 0

>fltmc instances
Filter Volume Name Altitude Instance Name Frame SprtFtrs VlStatus
-------------------- ------------------------------------- ------------ ---------------------- ----- -------- --------
wcifs C: 189900 wcifs Instance 0 00000000

No that is not a fix, as the only thing it does is suppress the (event id 4 'wcifs'). I didn't realize I had the system restore issue, until I started looking into the (Event id 4 'wcifs') issue and tried to do a system restore... lol. For all I know the two are not related at all, but I figured I had start some where.

Update and no this did NOT fix the system restore and I'm NOT recommending this as fix for (event id 4 'wcifs'), even tho it got rid of the (event id 4 'wcifs') for me.

I took a look thru the 'c:\system volume information' folder. and found a wcifs.md file (not clue what it does, as it just had a single ascii character in it. So, seeing how there is a SystemRestore folder is in there as well, I deleted the whole 'c:\system volume information' folder and let windows rebuild it. Set wcifs back to auto start. rebooted and created a restore point. No (event id 4 'wcfis'), but system restore still fails.

The System Restore fails: AppxStaging %ProgramFiles%\WindowsApp 0x80070091 (directory is not empty) may be an app locking a file or a permission issue but, it's just a guess. Forgive me for stating the obvious, but whichever app it is, was updated in the last couple of weeks and all of us having the issue got it...

Note: I have run chkdsk, sfc, dism, and they reported no issues.

Looks like MS failed big this time . System restore not working is only one of the symptoms. The FilterManager/wcifs-warning appears also when file-backup software is used or system images are made. An essential part of Windows broke down completely and most people will only discover when it is too late. What a mess.

Eagle51 said:

No that is not a fix, as the only thing it does is suppress the (event id 4 'wcifs'). I didn't realize I had the system restore issue, until I started looking into the (Event id 4 'wcifs') issue and tried to do a system restore... lol. For all I know the two are not related at all, but I figured I had start some where.

Update and no this did NOT fix the system restore and I'm NOT recommending this as fix for (event id 4 'wcifs'), even tho it got rid of the (event id 4 'wcifs') for me.

I took a look thru the 'c:\system volume information' folder. and found a wcifs.md file (not clue what it does, as it just had a single ascii character in it. So, seeing how there is a SystemRestore folder is in there as well, I deleted the whole 'c:\system volume information' folder and let windows rebuild it. Set wcifs back to auto start. rebooted and created a restore point. No (event id 4 'wcfis'), but system restore still fails.

The System Restore fails: AppxStaging %ProgramFiles%\WindowsApp 0x80070091 (directory is not empty) may be an app locking a file or a permission issue but, it's just a guess. Forgive me for stating the obvious, but whichever app it is, was updated in the last couple of weeks and all of us having the issue got it...

Note: I have run chkdsk, sfc, dism, and they reported no issues.

Seeing the same issue on all four of my PCs. If this impacts the successful use of VSS to make backup images, then I suggest that if your using Macrium that you make your backup images using the Macrium USB stick and not from within Windows. That method does not utilize VSS and hopefully would be successful.

Hi!

Thanks for the tip! Had an eye on Macrium already, also before this latest Windows 10 saga started. What holds me off a bit is that the Win 10 imager is a straight forward tool. It never failed, and restoring is possible with any Windows 10 boot stick / installation medium. Perfect. Also, what I understand from the Macrium website is that you get the full features including incremental backups only by running it under Win 10. And yes, then also VSS will be used. So making images via the Macrium bootstick might be a great workaround for the short term, it's probably not for the long run. Also: the Macrium bootstick is based on a Windows PE-environment. Macrium proudly announces at their site a new version of the software will be available from the 27th on. Including the latest Win PE-environment. Which actually might also contain the VSS-problems.

Nevertheless, I will consider it, since there are virtually no other options anymore. Sadly enough, because wcifs and VSS crash silently, most people will never know their backups are worth nothing. I would also never have gotten the idea to run an image tool outside Windows 10 itself, because there where never problems with creating images in Windows itself. :-/ Besides, 'only' one problem is solved with this solution of course. Incremental file backups and system restore points still don't work then, just like probably many things that use wcifs and vss.


anyway, Thanks again!

SoFine409 said:

Seeing the same issue on all four of my PCs. If this impacts the successful use of VSS to make backup images, then I suggest that if your using Macrium that you make your backup images using the Macrium USB stick and not from within Windows. That method does not utilize VSS and hopefully would be successful.