Registry Filter Overview (Standard 8)
7/8/2014
Review Registry Filter features in Windows Embedded 8 Standard (Standard 8).
Registry Filter enables you to persist specific registry keys or values across multiple reboots without requiring all changes in a hive to be persisted. The default behavior for a system protected by a write filter is that all commits to the registry hives are stored in a RAM overlay until shutdown or restart. Registry Filter monitors updates to specific registry keys, values, or both, and commits those changes to its own overlay. When the device reboots, the registry changes in the Registry Filter overlay are reapplied to RAM in order to persist the changes. Registry Filter, combined with Enhanced Write Filter (EWF) or File-Based Write Filter (FBWF), enables persistence of specific registry keys while protecting the rest of the OS. In Windows Embedded 8 Standard (Standard 8), Registry Filter is functionally very similar to its implementation in Windows Embedded Standard 7.
Registry Filter persists the following registry changes:
Device Domain Participation
To join a domain, you must update the system's secret every 30 days. This secret data is written to the registry. If the system volume is protected by EWF or FBWF, changes to the secret data are applied only to the RAM overlay. On subsequent restarts, this secret is erased from the device's memory. Because the domain controller believes that device secret has been successfully updated, it stores the secret in its database to be used the next time that the device attempts to participate in the domain. If the overlay is not committed before a restart, the changes are lost because the EWF or FBWF RAM cache is flushed. The device then uses the old secret when trying to authenticate itself with the domain controller. This causes the domain controller to deny the device access to domain resources.Terminal Services Client Access License (TSCAL)
For devices that use the Remote Desktop Client to connect to application servers, a TSCAL is issued when the system connects for the first time. If the system volume is protected by EWF or FBWF and the device is restarted, the license information (which is stored in the registry) is lost. The next time the device connects to the application server, it requests a new license that will be used even though a license was previously issued. Over time, the License Server runs out of licenses, and the quantity of licenses reported far exceeds the quantity used or required.Custom Keys
You can persist user-defined custom keys with Registry Filter. In Image Configuration Editor (ICE), you can specify whether you want to add, update, or delete a registry key.Important
You can only use Registry Filter to persist custom keys in the HKLM registry root. Registry Filter is not guaranteed to persist all registry keys in the SYSTEM hive because the system can update registry keys early in the startup process before Registry Filter loads. Registry Filter can only persist registry keys that change after it loads and starts tracking registry changes.
Add Registry Filter to Your Image
You can add Registry Filter to your image by adding the Registry Filter module to your design in Image Configuration Editor (ICE) or Image Builder Wizard (IBW).