My understanding is that on windows 2008 r2 the windows resource protection is on by default and will restore the tampered files within a few minutes of tampering.
testing shows this isn't happening though. we have to run sfc /scannow manually in order to detect the tampering.