I attempted to roll out the WMF patch for the big security hole everyone has been talking about lately. After pushing it to a few machines as a test, these users started to complain that they were getting a message about windows file protection. It looks like when you attempt to push this patch to Windows 2000 machines, the windows file protection will kick in and stop it in its tracks.
I found the registry key that lets you disable it (I would suggest only while you are deploying the patch)
Open regedit, and browse to this key:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon
Find the value SFCDisable
Set it to this hex dword value to turn of windows file protection: ffffff9d
If you want to turn it back on, switch it to zero.
It takes effect almost immediately, and you can deploy the patch right after making the change with no problems.
If you don’t like mucking around in the registry, I wrote a program that will do it for you.