May unexpected power losses causes UWF to fail?

Question

Hello,

we use UWF in one of our cumster's systems (Windows 10 IoT Enterprise 2019 LTSC), and told them that they may use Sean Liming's "UWFUtility" to configure UWF since Windows 10 does not provide the nice GUI tools known from Windows Embedded Standard 7 or the MMC-Plugin from Windows 8.1 "Embedded".

After some months of operation our customer claims that the "UWFUtility terminates with an execption" immediately when started. Analysis has shown that:

• As per stack trace from event viewer, it seems that the tools seems to attempt some kind of enumeration
• Checking the WMI Provider shows that there is no instance for the "UWF_Filter" class any more (compared against a new system where UWF works)
• Even the uwfmgr utility reject command like "uwfmgr get-config" with error "Access denied"

My assumption is that the UWF configuration has became damaged in some way. It is known that the customer does not shutdown the system before power interruption. Use of UWF - among others - is based on the supposition that it should protect the file system even in case of unexpected power losses. Now I have some doubts if this is really true...

Are there any known issues regarding UWF and unexpected power losses? Or do you have any ideas how the UWF configuration may became damaged, or what else could happen that UWF does not work any more?

Have much thanks in advance.

Yours Willi K.

Answer 1

Hello @Willi K

Indeed seems some sort of corruption. I would recommend:

1. repair Windows image:
   https://learn.microsoft.com/en-us/windows-hardware/manufacture/desktop/repair-a-windows-image
2. Rebuid WMI repository
   https://techcommunity.microsoft.com/t5/ask-the-performance-team/wmi-rebuilding-the-wmi-repository/ba-p/373846
3. Reset UWF:
   run> uwfmgr filter disable

Reboot system

then Run> uwfmgr filter reset-settings

Then enable UFW again and set it up.

Hope this helps in your case!,
Best regards,

Answer 2

Hello LimitlessTechnology-2700,

thanks for your quick reply. As already stated, I had some luck in getting the UWFUtility working again. Not the big problem yet, but I need to go on to figure out how to fix the problem with the missing WMI instances (I'll try your sugeestions regarding that later).

Do other question the customer is requesting an answer for: How can this happen. I you have an idea, don't hesitate to tell us what you mean ;-)
However, thanks for your inputs.

I will post my experience here once I've found out what's going on here.

Yours Willy K.

Answer 3

OK, after some more investigation it seems to be related to permissions (?). If I run "uwfmgr get-config" / check WMI providers using WMIExplorer as common user, I get "access denied" resp. the instance of UWF_Filter class is missing (this does not happen on a cleanly installed system). If I do the same as Administrator everything is fine (also the UWF_Filter class is available).

I compared the permissions through root\StandardCimv2\embedd using winmgmt.msc but they are the same. What kind of permissions may block here?

Answer 4

uwfmgr.exe and UWF WMI API (UWFUtility.exe) require elevated Administrative privileges. If you run UWFUtility.exe as Administrator or uwfmgr.exe in a elevated command window, do they run correctly?

Answer 5

Hi all,

I'm still on investigating, but had to interrupt for some time due to illness. Unfortunately the number of complains have increased to around 5 in mean time, and we need to find out how to get rid of that problem.

The "power-cut-test" I have announced recently has also been performed in mean time, but after 50 power off/on sequences w/o shutting O/S down properly - as seen on customer's device - did not raise that problem (in meaning of UWFUtiliy was still working). We did this a second time where we UWF was enabled, but we were not able to reproduce the problem in that way.

There was an interesting insight during this tests: As already mentoined, we have seen lots of critical entries in the System event log that tell that the system has restarted w/o shutting down properly. During our tests such message were only produced when UWF was disabled (note: System.evtx is written to a non-protected partition). I already assumed that s/o at customer's site forgot to enable UWF, but know I'm in doubt since number of error reports of this kind increases. In looking forward that customers claim/assure they have UWF enabled, the new question is,**if UWF has/may has become disabled w/o being instructed to to so ** (neither by uwfmgr nor UWFUtility). UWF also has an own eventlog, but I didn't know that before and therefore logs to protected volume - so I also can see that UWF was set to enabled, but no information when it has become disabled.

A second device has been returned to our site that still has the problem. Is there anything I can inspect that might help to find out what happened?

Regarding UWFUtility itself, here is what the Application EventLog has recoreded (translated):

Record # 1: Application error, EventId 1000 (Category: Application crash)
Application: UWFUtility.exe, Version: 2.0.0.0, Timestamp: 0x599a0c08
Name of faulting module: KERNELBASE.dll, Version: 10.0.17763.1728, Timestamp: 0x16e07148
Exception code: 0xe0434352
Error offset: 0x001226c2
ID of failing process: 0x7fc
Startup time of faulting application: 0x01d7941b7f472737
Path to faulting application: C:\Program Files\UWFUtility\UWFUtility.exe
Name of faulting module: C:\Windows\System32\KERNELBASE.dll

**Record #2: .Net Runtime, EventId 1026 (Category: None)
Application: UWFUtility.exe
Framework version: v4.0.30319
Description: The process has been terminated because of an unhandled exception.
Exception information: System.Management.ManagementException
at System.Management.ManagementException.ThrowWithExtendedInfo(System.Management.ManagementStatus)
at System.Management.ManagementObjectCollection+ManagementObjectEnumerator.MoveNext()
at UWFUtility.UWFUtility.UWFStatus()
at UWFUtility.UWFUtility..ctor()
at UWFUtility.Program.Main()