Managing Software Updates with Write Filters
8/29/2011
When using Enhanced Write Filter (EWF) or File-Based Write Filter (FBWF) protection on the drive for a computer, all uncommitted writes to the device are lost when the device restarts (unless the EWF is in disk mode, which is not available in Windows Embedded Standard 7). This includes any software or software updates that have been installed. To persist changes when the device restarts, the EWF or FBWF must be turned off prior to performing the change or the changes must otherwise be explicitly committed to the drive by using the commit command. This is required regardless of the method used to install software or software updates.
Use the following steps to persist changes when the device is restarted:
Note: You can use task sequences to manage write filters on the client. For information on task sequences, see Install Software Updates Task Sequence Action Variables.
To write changes by disabling and then enabling the EWF or FBWF
- Disable the EWF or FBWF. Disabling the filter will take effect after the next restart. All changes to the computer made prior to the restart are discarded before EWF or FBWF is disabled.
- After the restart, all new changes are written directly to the storage device. The drive remains unprotected until EWF or FBWF is re-enabled.
- The required changes can now be made, such as installing or updating software, and changing system settings.
- After the necessary changes to the system have been made, EWF or FBWF can be re-enabled. This causes EWF or FBWF to be enabled after the next restart. All changes prior to the restart are saved on the storage device.
- After the computer is restarted, it returns to a protected state.
Instead of disabling EWF or FBWF to make changes, you can use the commit command to make changes without disabling EWF:
To use the commit command to write changes with EWF
- Restart the computer to clear any changes that were made to the protected volume.
- Make the required changes to the computer, such as installing or updating software, and changing system settings.
- Issue the commit command to cause all changes made to the computer to be committed to the storage device after the next restart.
- After the computer is restarted, any changes to the computer are committed and it returns to a protected state.
- If any items that have been installed require a restart, a second restart might be required. Any changes caused by this second restart will be automatically committed to the storage device.
Note: When committing changes with EWF in disk mode, you must commit changes on the correct overlay level (if overlay levels are used). For more information, see EWF Manager Commands.
With the first method, you can handle any additional restarts as part of your software installation before re-enabling the write filter.
The use of write filters imposes unique requirements on system administrators who are tasked with change management. One option for administrators is to use a script to automate the additional actions needed to complete a software or software update installation.
Administrators who manage computers with writer filters enabled must carefully manage any software or software updates that modify registry settings during installation. To persist new registry settings, Registry Filters must be disabled (if enabled). For more details, see Registry Filters.