| Event Id | 3002 |
| Source | Microsoft-Windows-CodeIntegrity |
| Description | Code Integrity is unable to verify the image integrity of the file %2 because the set of per-page image hashes could not be found on the system. |
| Event Information | According to Microsoft : Cause : This event is logged when Code Integrity is unable to verify the image integrity of the file. Resolution : Replace the system file by using Startup Repair The page hash of the system file must match the hash stored in the system security catalog. If the hashes do not match, you should replace the system file with a version that has the correct hash. This can be done by using Startup Repair. To use Startup Repair to replace a system file: 1.Insert the Windows product disc. 2.Restart the computer. 3.When prompted, press any key to start the computer from the Windows product disc. 4.Choose the appropriate language settings, and then click Next. 5.Click Repair your computer. 6.Select the operating system you want to repair, and then click Next. 7.On the System Recovery Options menu, click Startup Repair. 8.When Startup Repair has finished, restart the computer. Verify : To verify that user-mode files were sucessfully validated and loaded, confirm that Event ID 3002 or 3003 are no longer being logged to the Microsoft-Windows-CodeIntegrity operational event log channel. To perform this procedure, you must be a member of the local Administrators group, or you must have been delegated the appropriate authority. To confirm that Event ID 3002 or 3003 are no longer being logged to the Code Integrity operational channel: 1.Click Start, point to Administrative Tools, and then click Event Viewer. 2.Expand Applications and Service Logs, expand Microsoft, expand Windows, expand CodeIntegrity, and then click Operational. 3.Click to sort the events on the Date and Time column. 4.Look for an instance of Event ID 3002 or 3003 that is after the date and time the issue was resolved. 5.If no instances are found, user-mode files are being successfully validated and loaded. |
| Reference Links | Event ID 3002 from Microsoft-Windows-CodeIntegrity |
Catch threats immediately
We work side-by-side with you to rapidly detect cyberthreats
and thwart attacks before they cause damage.