How does Windows File Protection prevent file overrides in XP?

[Krismosy]

Thanks for reading,
This morning, a customer complains my explanation as to why the ntoskrnl.exe in XP SP3 seems able to clone itself if overriden. I stated that it was a feature MS people tried their best to protect their genuine version via WPF mechanism. He convinced me that his XP Home hadn't ever been doing something similar with examples. The problem is that it still clones even though I logged on my computer in safe-mode already. I was blushed!
Long story short, someone could offer me a convincing evidence or explanation I would need to consider for, perhaps, next customers ?

 

[Borg]

Thanks for reading,
This morning, a customer complains my explanation as to why the ntoskrnl.exe in XP SP3 seems able to clone itself if overriden. I stated that it was a feature MS people tried their best to protect their genuine version via WPF mechanism. He convinced me that his XP Home hadn't ever been doing something similar with examples. The problem is that it still clones even though I logged on my computer in safe-mode already. I was blushed!
Long story short, someone could offer me a convincing evidence or explanation I would need to consider for, perhaps, next customers ?

http://en.wikipedia.org/wiki/Ntoskrnl" .

With Windows File Protection active, replacing or deleting a system file that has no file lock to prevent it getting overwritten causes Windows to immediately and silently restore the original copy of the file. The original version of the file is restored from a cached folder which contains backup copies of these files.