统一写入筛选器 (UWF)功能Unified Write Filter (UWF) feature

统一写入筛选器 (UWF) 是一项可选的 Windows 10 功能,可通过拦截和重定向到驱动器的任何写入操作来帮助保护驱动器, (应用安装、设置更改、将数据) 保存到虚拟覆盖区。Unified Write Filter (UWF) is an optional Windows 10 feature that helps to protect your drives by intercepting and redirecting any writes to the drive (app installations, settings changes, saved data) to a virtual overlay. 虚拟覆盖是一个临时位置,通常在重新启动过程中或在来宾用户注销时清除。The virtual overlay is a temporary location that is usually cleared during a reboot or when a guest user logs off.


  • 为经常使用来宾的瘦客户端和工作区(如学校、图书馆或宾馆计算机)提供干净体验。Provides a clean experience for thin clients and workspaces that have frequent guests, like school, library or hotel computers. 来宾可以工作、更改设置和安装软件。Guests can work, change settings, and install software. 设备重新启动后,下一个来宾会收到干净的体验。After the device reboots, the next guest receives a clean experience.

  • 提高网亭、IoT embedded 设备或其他不应经常添加新应用的设备的安全性和可靠性。Increases security and reliability for kiosks, IoT-embedded devices, or other devices where new apps are not expected to be frequently added.

  • 可用于减少固态硬盘和其他写敏感介质的磨损。Can be used to reduce wear on solid-state drives and other write-sensitive media.

UWF 会将 Windows 7 增强型写入筛选器 (EWF) 和基于文件的写入筛选器 (FBWF) 。UWF replaces the Windows 7 Enhanced Write Filter (EWF) and the File Based Write Filter (FBWF).


  • UWF 可以保护最受支持的可写入存储类型,包括物理硬盘、固态驱动器、内部 USB 设备和外部 SATA 设备。UWF can protect most supported writable storage types, including physical hard disks, solid-state drives, internal USB devices, and external SATA devices. 不能使用 UWF 来保护外部可移动驱动器、USB 设备或闪存驱动器。You cannot use UWF to protect external removable drives, USB devices or flash drives. 支持主启动记录 (MBR) 和 GUID 分区表 (GPT) 卷。Supports both master boot record (MBR) and GUID partition table (GPT) volumes.

  • 可以使用 UWF 将只读媒体作为可写卷显示到 OS。You can use UWF to make read-only media appear to the OS as a writable volume.

  • 你可以使用 uwfmgr.exe在 Windows 10 设备上直接管理 UWF,或使用 UnifiedWriteFilter CSPUWF WMI等 MDM 工具以远程方式使用 Microsoft Intune。You can manage UWF directly on a Windows 10 device using uwfmgr.exe, or remotely using MDM tools like Microsoft Intune using the UnifiedWriteFilter CSP or the UWF WMI.

  • 你可以通过使用 UWF 服务模式或将文件和注册表排除添加到特定系统区域,来 更新和维护受 uwf 保护的设备You can update and service UWF-protected devices, either by using UWF servicing mode or by adding file and registry exclusions to specific system areas.

  • 在 Windows 10 版本1803上,你可以使用 永久性覆盖 ,以允许在虚拟覆盖中保存的数据甚至在重新启动后仍可保留。On Windows 10, version 1803, you can use a persistent overlay to allow data saved in the virtual overlay to remain even after a reboot.

  • 在具有磁盘覆盖的设备上,可以使用 可用空间传递 来访问驱动器的额外可用空间。On devices with a disk overlay, you can use freespace passthrough to access your drive's additional free space.

  • 如果页面文件存在于未受保护的卷上,则 UWF 支持分页以增加虚拟内存。UWF supports paging to increase virtual memory, if the page file exists on an unprotected volume. 将分页与基于 RAM 的覆盖一起使用时,系统的运行时间会大幅增加。When paging is used together with a RAM-based overlay, the uptime of the system can be significantly increased.


Windows 10 企业版、Windows 10 IoT 核心版或 Windows 10 IoT 企业版。Windows 10 Enterprise, Windows 10 IoT Core, or Windows 10 IoT Enterprise.


  • 文件系统:File systems:

    • FAT:完全受支持。FAT: fully supported.
    • NTFS:完全受支持。NTFS: fully supported. 但是,在设备启动过程中,NTFS 文件系统日志文件可以写入受保护的卷,然后 UWF 就会开始保护卷。However, during device startup, NTFS file system journal files can write to a protected volume before UWF has started protecting the volume.
    • 其他文件系统 (示例: exFAT) :可以保护卷,但不能在卷上创建文件排除或执行文件提交操作。Other file systems (example: exFAT): You can protect the volume, but cannot create file exclusions or do file commit operations on the volume. 写入排除的文件仍会影响覆盖的增长。Writes to excluded files still influence the growth of the Overlay.
  • 覆盖不会镜像整个卷,但会动态增大,以跟踪重定向的写入。The overlay does not mirror the entire volume, but dynamically grows to keep track of redirected writes.

  • UWF 支持多达 16 tb 的受保护卷。UWF supports up to 16 terabytes of protected volumes.

  • UWF 不支持在关闭设备时使用快速启动。UWF does not support the use of fast startup when shutting down your device. 如果启用了 "快速启动",则关闭设备不会清除覆盖区。If fast startup is turned on, shutting down the device does not clear the overlay. 可以通过导航到 "控制面板" " > 所有控制面板项" " > 电源选项" " > 系统设置 ",并清除 " 建议) 的" 打开快速启动 ("旁边的复选框,在控制面板中禁用" 快速启动 "。You can disable fast startup in Control Panel by navigating to Control Panel > All Control Panel Items > Power Options > System Settings and clearing the checkbox next to Turn on fast startup (recommended).

  • UWF 不支持 存储空间UWF does not support Storage Spaces.

  • 已启用 UWF 并用于保护驱动器 C的计算机上,不能将日期和时间永久设置为过去的时间。On a computer on which UWF is enabled and used to protect drive C, you cannot permanently set the date and time to a past time. 如果进行了此类更改,则在计算机重新启动后,将还原原始日期和时间设置。If you make such a change, the original date and time settings will be restored after the computer restarts.

    若要解决此问题,必须在更改日期和时间之前禁用 UWF。To work around this issue, you must disable UWF before you change the date and time. 为此,请运行 uwfmgr.exe 筛选器禁用。To do this, run uwfmgr.exe filter disable.


    不要添加保留日期和时间设置的文件 ( "%windir%\bootstat.dat" ) 写入筛选器排除 项来解决此问题。Do not add the file that retains date and time settings ("%windir%\bootstat.dat") to the write filter exclusions to work around this issue. 这样做会导致停止错误,0x7E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) 出现。Doing this causes Stop error 0x7E (SYSTEM_THREAD_EXCEPTION_NOT_HANDLED) to occur.

启用和配置 UWFTurn on and configure UWF

UWF 是一个可选组件,在 Windows 10 中默认情况下不启用。UWF is an optional component and is not enabled by default in Windows 10. 必须先 启用 UWF ,然后才能对其进行配置。You must turn on UWF before you can configure it.

UWF 覆盖UWF overlay

你可以选择覆盖的存储位置 (RAM 或磁盘) ,保留多少空间,确定覆盖是否在重新启动后仍然存在。You can choose where the overlay is stored (RAM or disk), how much space is reserved, whether the overlay persists after a reboot.

若要增加运行时间,请设置监视以检查覆盖区是否已满。To increase uptime, set up monitoring to check if your overlay is filling up. 在某些级别,设备可以警告用户和/或重新启动设备。At certain levels, your device can warn users and/or reboot the device.

若要了解详细信息,请参阅 UWF 覆盖位置和大小To learn more, see UWF Overlay location and size.


卷是一种逻辑单元,表示到操作系统使用的文件系统的持久存储区。A volume is a logical unit that represents an area of persistent storage to the file system that is used by the OS. 卷可以对应于单个物理存储设备(如硬盘),但卷还可以对应于具有多个分区的物理存储设备上的单个分区,也可以跨多个物理存储设备。A volume can correspond to a single physical storage device, such as a hard disk, but volumes can also correspond to a single partition on a physical storage device with multiple partitions, or can span across multiple physical storage devices. 例如,RAID 阵列中的硬盘集合可以表示为操作系统的单个卷。For example, a collection of hard disks in a RAID array can be represented as a single volume to the OS.

将 UWF 配置为保护卷时,可以通过使用驱动器号或卷设备标识符来指定卷。When you configure UWF to protect a volume, you can specify the volume by using either a drive letter or the volume device identifier. 若要确定卷的设备标识符,请在 Win32 _ 卷 WMI 类中查询 DeviceID 属性。To determine the device identifier for a volume, query the DeviceID property in the Win32_Volume WMI class.

如果使用驱动器号指定卷,则 UWF 使用 松散绑定 来识别卷。If you specify a volume using a drive letter, UWF uses loose binding to recognize the volume. 如果硬件或卷配置发生更改,则可以使用松散绑定将驱动器号分配给不同的卷。By using loose binding, drive letters can be assigned to different volumes if the hardware or volume configuration changes. 如果使用卷设备标识符指定卷,则 UWF 将使用 紧密绑定 来识别该卷。If you specify a volume using the volume device identifier, UWF uses tight binding to recognize the volume. 通过使用紧密绑定,设备标识符对于存储卷是唯一的,且独立于文件系统分配给卷的驱动器号。By using tight binding, the device identifier is unique to the storage volume and is independent from the drive letter assigned to the volume by the file system.


如果要使用 uwf 保护卷,同时排除特定文件、文件夹或注册表项不受 UWF 的筛选,则可以将其添加到 写入筛选器排除 列表。If you want to protect a volume with UWF while excluding specific files, folders, or registry keys from being filtered by UWF, you can add them to a write filter exclusion list.

UWF 服务模式UWF servicing mode

当设备使用 UWF 进行保护时,必须使用 UWF 服务模式命令对设备进行服务并将更新应用于映像。When a device is protected with UWF, you must use UWF servicing mode commands to service the device and apply updates to an image. 你可以使用 UWF 服务模式应用 Windows 更新、反恶意软件签名文件更新以及自定义软件或第三方软件更新。You can use UWF servicing mode to apply Windows updates, antimalware signature file updates, and custom software or third-party software updates.

有关如何使用 UWF 服务模式将软件更新应用于设备的详细信息,请参阅 服务 UWF 保护的设备For more information about how to use UWF servicing mode to apply software updates to your device, see Service UWF-protected devices.

UWF 疑难解答Troubleshooting UWF

UWF 使用 Windows 事件日志来记录与覆盖消耗、配置更改和服务有关的事件、错误和消息。UWF uses Windows Event Log to log events, errors and messages related to overlay consumption, configuration changes, and servicing.

若要详细了解如何查找事件日志信息以排查 (UWF) 的统一写入筛选器问题,请参阅 统一写入筛选器 (UWF) For more information about how to find event log information for troubleshooting problems with Unified Write Filter (UWF), see Troubleshooting Unified Write Filter (UWF).

无品牌启动Unbranded Boot

自定义登录Custom Logon

Shell 启动程序Shell Launcher