| Event Id | 6406 |
| Source | Windows File Protection |
| Description | The system file Filename was not restored to its original, valid version because the WFP restoration process was canceled by user interaction, user name is UserID. |
| Event Information | The Windows File Protection feature (WFP) logs an event if WFP is canceled while it is performing a scan of the system files or attempting to replace an individual file. This information is recorded for later review in the System event log. |
| Reference Links | Windows File Protection Creates Event Log Entry When Scanning Is Stopped |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.