I have searched for a write filter exclusion, but not found any. I have searched for a way to see, what is written to the write filter buffer, but not found any. I have found this old command for Windows 8: "uwfmgr overlay get-files c:" But that does not work for Windows 10 Enterprise IOT. I have used the command: uwfmgr overlay get-availablespace And the available space is suddenly decresing, but the task manager says that there is 0 bytes written to the disk. I hope that somebody is able to help me with this problem. Question: How do I find the filenames and/or programs that are writing to the protected disk? Question: How do I preserve the event logs after reset.

I have a utility that implements the get-files call: https://www.annabooks.com/SW_UWFUtility.html . Click on the Overlay files tab to get a list. I typically open exclusions on a couple of folders: uwfmgr.exe file add-exclusion c:\Windows\System32\winevt\Logs uwfmgr.exe file add-exclusion c:\Windows\assembly

Hi @Søren Bonefeld , Welcome to Microsoft Q&A! Firstly, i recommend you read this about UWF: https://video2.skills-academy.com/en-us/windows/iot-core/secure-your-device/unifiedwritefilter When protecting the data volume, we recommend that you add exceptions for the servicing and logging folders that are accessed by Windows OS Services. See this part in the link above: Recommended Exclusions which contains log folders. Then, maybe you can find the root cause. I answered your question indirectly, hope this helps you. Best regards, Seeya If the answer is the right solution, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment". Note: Please follow the steps in our <a href="https://nam06.safelinks.protection.outlook.com/?url=https%3A%2F%2Fvideo2.skills-academy.com%2Fen-us%2Fanswers%2Farticles%2F67444%2Femail-notifications.html&data=04%7C01%7Cv-linsyu%40microsoft.com%7C406ab7ce595e4231457208d98ec04c53%7C72f988bf86f141af91ab2d7cd011db47%7C1%7C0%7C637697778836244725%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C1000&sdata=uQ4Qtk2yKrZMliUMyPBgwcKXOd6vKLrHsWoHNih%2BviM%3D&reserved=0" rel="ugc nofollow">documentation to enable e-mail notifications if you want to receive the related email notification for this thread.

System with UWF on resets every 4-5 minutes and the event log is empty after the reset

Accepted answer

Sean Liming 4,591 Reputation points

2022-03-12T16:37:40.76+00:00

I have a utility that implements the get-files call: https://www.annabooks.com/SW_UWFUtility.html. Click on the Overlay files tab to get a list.

I typically open exclusions on a couple of folders:
uwfmgr.exe file add-exclusion c:\Windows\System32\winevt\Logs
uwfmgr.exe file add-exclusion c:\Windows\assembly
Please sign in to rate this answer.
Søren Bonefeld 41 Reputation points

2022-03-18T14:08:26.853+00:00

The Answer is not complete but it helped me expand my filter.

Sean Liming 4,591 Reputation points

2022-03-18T15:16:06.41+00:00

What is missing?

Søren Bonefeld 41 Reputation points

2022-03-21T08:14:32.963+00:00

The computer still resets every 5-10 minuts.

I cannot see what files are written to the UWF overlay,
but your filter "uwfmgr.exe file add-exclusion c:\Windows\System32\winevt\Logs" helped me to see, that aparently the Windows 21H2 still runs:
* Windows updates
* Windows defender definition updates

But all Windows updates should have been disabled by the UWF Enable.

Thanks for your help.

Sean Liming 4,591 Reputation points

2022-03-21T15:18:18.33+00:00

If UWF is disabled does this periodic reboot still occur?
Do you see a BSOD screen appear at any point?

Check the scheduled tasks to make sure that any Windows Update tasks are disabled. There is some registry setting to force WU off.

Søren Bonefeld 41 Reputation points

2022-03-22T13:03:57.587+00:00

UWF is enabled, if I disable it, the problem disapears for some days.
I suspect, that it is Windows Update, but Windows Update should not be running when UWF is enabled???
185636-status.txt
This is a copy of my current exclusions:
uwfmgr volume protect C:

uwfmgr.exe file Add-Exclusion C:\Data
uwfmgr.exe file add-exclusion c:\Windows\System32\winevt\Logs
uwfmgr.exe file add-exclusion c:\Windows\assembly

uwfmgr.exe registry Add-Exclusion HKLM\Software\WinIoT

The uploaded status.txt is the current status from the UWF.

Aldo Dolfi 0 Reputation points

2024-09-02T14:21:30.3266667+00:00

Hi @Søren Bonefeld , it looks like I am having the same problem that you describe.
I have noticed that in my case the UWF configuration is messed up (multiple C: drives were protected, likely a side effect of image preparation).

However, even after cleaning up the configuration, I experience unexpected file downloads, I got a notification alert which said "Windows is downloading updates".

I do not understand why updates are running on this system if updated have been globally disabled, according to IoT Enterprise documentation, with the policy Computer Configuration\Administrative Templates\Windows Components\Windows update\Configure Automatic Updates set to disabled.

Did you manage to get to the bottom of the unexpected updates?

@Sean Liming Do I really have to manually disable the Windows Update scheduled task? Will UWF service mode still work then?

Sean Liming 4,591 Reputation points

2024-09-13T15:31:15.2666667+00:00

@Aldo Dolfi there is more to disabling WU than just a Group Policy setting. There are a number of registry keys to null out and the scheduled task that also need to be a disabled/deleted. Of course, the WU service needs to be disabled. If Edge is in the system, the Edge update service needs to be disabled.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

System with UWF on resets every 4-5 minutes and the event log is empty after the reset

1 additional answer

Your answer