SOLVED! File System Filter ‘wcifs’

Regarding File System Filter ‘wcifs’ (Event ID: 4) in Event Viewer, it’s a good idea to reattach the file screening minifilter driver. Aside from that, you may want to apply changes to WindowsApps permissions at the earliest opportunity. You seek in-depth instructions on what must be done? In that case, this article should be of use to you.

A List of Suspects

Attachment Failure

Based on the content of the entry, it is safe to assume that there has been an attachment failure. File screening enforcement only works when the file screening minifilter driver is functional and correctly attached to the volume. Needless to say, if the above condition is not met, Event Viewer is going to log an entry about File System Filter ‘wcifs’.

Microsoft Office

Many users have reported seeing File System Filter ‘wcifs’ following a Windows 10 update for the “Get Office” app. After diving deep into the system, we could say with confidence that a certain “Microsoft.MicrosoftOfficeHub_17.8107.7600.0_x64__8wekyb3d8bbwe” folder is responsible.


Reattach The File Screening Minifilter Driver

In the beginning, you should reattach the file screening minifilter driver to the volume At the earliest opportunity. To do so, go through the steps down below:

  • Step 1. Go to Search bar, type cmd and click Run as administrator.
  • Step 2. In Command Prompt (Admin), run the command:  fltmc attach datascrn [Volume drive letter:]. Of course, you should replace [Volume drive letter:] with the actual name of your drive. For instance, fltmc attach datascrn C:.
  • Step 3. Proceed to run the command fltmc instances
  • Step 4. Search for a Datascrn instance listed for the volume. If it is there, that means the File Screening Minifilter Driver is successfully attached.

Change WindowsApps Permissions

If you suspect the “Microsoft.MicrosoftOfficeHub_17.8107.7600.0_x64__8wekyb3d8bbwe” is at fault, you have to delete it. The process is not a walk in the park though as you must change administrator permissions.  For starters, you need to enable the viewing of hidden files and folders.

  • Step 1. Open File Explorer.
  • Step 2. On the top left side, go to File > Options.
  • Step 3. On the View tab, pick the “Show hidden files, folders, and drives” option under Hidden files and folders.
  • Step 4. Apply the changes.

Now you can begin changing permissions for the folder in question.

  • Step 1. Open File Explorer and go to C:\Program Files (Drive name may be different depending on your PC).
  • Step 2. Locate the WindowsApp folder, right-click it and click Properties.
  • Step 3. On the Security tab, click Advanced.
  • Step 4. On the next window, click Change owner.
  • Step 5. Enter your current computer username(E.g Admin) and click OK.
  • Step 6. Tick the box next to “Replace owner on subcontainers and objects” and click OK.
  • Step 7. Click OK again to finalize the settings and close the window.

For the next phase, you need to open an elevated Command prompt and grant your administrator account full permission for the WindowsApp folder.

  • Step 1. Go to Search bar, type cmd and click Run as administrator.
  • Step 2. In Command Prompt (Admin), run the command: icacls “%ProgramFiles%\WindowsApps” /grant [Your Username]:F 
  • Step 3. Proceed to run the command:
    icacls “%ProgramFiles%\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8107.7600.0_x64__8wekyb3d8bbwe” /grant [Your Username]:F /t

Assuming that things proceed smoothly, you should now have full access to the required folder under WindowsApp. All that’s left to do is delete it before swapping the WindowsApp permission back to its original state.

  • Step 1. To delete the folder and its contents, run the following command in Command Prompt (Admin) :
    rd “%ProgramFiles%\WindowsApps\Microsoft.MicrosoftOfficeHub_17.8107.7600.0_x64__8wekyb3d8bbwe” /S /Q
  • Step 2. Return the WindowsApps folder’s permission to default, which is Trusted Installer by running this command:
    icacls “%ProgramFiles%\WindowsApps” /setowner “NT Service\TrustedInstaller”
  • Step 3. Close the Command Prompt and see how things turn out.

Frequently Asked Questions

What does File System Filter ‘wcifs’ mean?

It is an error logged into the Event Viewer that usually appears when Windows boots up. The full error log is:  “File System Filter ‘wcifs’ (Version 10.0, ‎2016‎-‎09‎-‎15T11:42:03.000000000Z) failed to attach to volume ‘\Device\HarddiskVolumeShadowCopy10’. The filter returned a non-standard final status of 0xC000000D. This filter and/or its supporting applications should handle this condition. If this condition persists, contact the vendor.”

Some details may vary depending on the computer. Regardless, based on the information provided here, it is safe to assume that this is an error that happens when the file screening minifilter driver isn’t properly attached to the volume. Furthermore, a certain folder under Microsoft Office’s WindowsApps folder is known to cause this problem.

Where can I find WindowsApps folder and how do I access it?

Being a hidden folder, you need to enable viewing of hidden files and folders to be able to see it. Regardless of where you chose to install MS Office, it is found under C:\Program Files, though the drive name can be different. Make sure you are looking at Program Files and not Program Files(x86), as they are entirely different folders. Since the folder is restricted, follow the steps provided in this article to change permissions and gain access to it.

What does the WindowsApps folder contain?

This folder is inaccessible under normal circumstances for a reason. It contains all the necessary files for the default Windows applications as well as any app you download from the Microsoft Store. It is advised to take due caution when handling this folder as a wrong move will cause many issues to surface.

Leave a Comment