统一写入筛选器 (UWF) 覆盖位置和大小Unified Write Filter (UWF) overlay location and size

统一写入筛选器 (UWF) 通过拦截受保护卷的写入尝试并将这些写入尝试重定向到虚拟覆盖,来保护卷的内容。The Unified Write Filter (UWF) protects the contents of a volume by intercepting write attempts to a protected volume and redirects those write attempts to a virtual overlay.

你可以选择在 RAM 或磁盘) (存储覆盖位置、保留多少空间,以及覆盖覆盖时所发生的情况。You can choose where the overlay is stored (RAM or disk), how much space is reserved, and what happens when the overlay fills up.

若要增加运行时间,请设置监视以检查覆盖区是否已满。To increase uptime, set up monitoring to check if your overlay is filling up. 在某些级别,设备可以警告用户和/或重新启动设备。At certain levels, your device can warn users and/or reboot the device.

RAM 重叠与磁盘覆盖RAM overlay vs. disk overlay

  • Ram 覆盖 (默认) :虚拟覆盖存储在 RAM 中,并在重新启动后清除。RAM overlay (default) : The virtual overlay is stored in RAM, and is cleared after a reboot.

    • 通过写入 RAM,可以减少对写敏感介质(如固态硬盘)的磨损。By writing to RAM, you can reduce the wear on write-sensitive media like solid-state drives.
    • RAM 通常比驱动器空间的限制更多。RAM is often more limited than drive space. 随着驱动器覆盖填满可用 RAM,设备性能可能会降低,最终系统会提示用户重新启动设备。As the drive overlay fills up the available RAM, device performance could be reduced, and users will eventually be prompted to reboot the device. 如果用户预计会对覆盖区进行大量写入操作,请考虑改用磁盘覆盖。If your users are expected to make many large writes to the overlay, consider using a disk overlay instead.
  • 磁盘覆盖 :虚拟覆盖存储在驱动器上的临时位置。Disk overlay : The virtual overlay is stored in a temporary location on the drive. 默认情况下,重启时会清除覆盖区。By default, the overlay is cleared on reboot.

    • 可以使用 可用空间传递 来使用超出保留虚拟覆盖空间的驱动器上的额外可用空间。You can use freespace passthrough to use additional free space on the drive beyond the reserved virtual overlay space.
    • 在 Windows 10 版本1803上,你可以使用 永久性覆盖 来允许用户在重启后在虚拟覆盖区中保存工作。On Windows 10, version 1803, you can use persistent overlay to allow users to save work in the virtual overlay even after a reboot.

覆盖大小Overlay size

  • 默认值为1024MB。Default=1024MB. 设置为:Set with:
    • CMDuwfmgr overlay set-sizeCMD: uwfmgr overlay set-size
    • CSPNextSession/MaximumOverlaySizeCSP: NextSession/MaximumOverlaySize
    • WMIUWF\Overlay.SetMaximumSizeWMI: UWF\Overlay.SetMaximumSize

规划设备部署时,建议优化覆盖大小以满足你的需求。When planning device rollouts, we recommend optimizing the overlay size to fit your needs.

对于 RAM 重叠,需要为系统的某些 RAM 提供预算。For RAM overlays, you'll need to budget some RAM for the system. 例如,如果 OS 需要 2 GB RAM,而你的设备有 4 GB RAM,请将覆盖的最大大小设置为 2048MB (2 GB) 或更少。For example, if the OS requires 2 GB of RAM, and your device has 4 GB of RAM, set the maximum size of the overlay to 2048MB (2 GB) or less.

建议在测试设备上启用 UWF,安装必要的应用,并通过使用情况模拟来放置设备。We recommend enabling UWF on a test device, installing the necessary apps, and putting the device through usage simulations. 您可以使用此 Powershell 脚本来找出使用空间的文件:You can use this Powershell script to find out which files are consuming space:

$wmiobject = get-wmiobject -Namespace "root\standardcimv2\embedded" -Class UWF_Overlay 
$files = $wmiobject.GetOverlayFiles("c:") 
$files.OverlayFiles | select-object -Property FileName,FileSize  | export-csv -Path D:\output.csv 

使用的覆盖量将取决于:The amount of overlay used will depend on:

  • 设备使用模式。Device usage patterns.
  • 可以访问的应用。Apps that can be accessed. (某些应用具有高写入量,并且会更快地填充重叠。 ) (Some apps have high write volumes and will fill up the overlay faster.)
  • 重置之间的时间。Time between resets.
  • 删除文件时,UWF 会将它们从覆盖区中删除,并将已释放的资源返回到可用池。When files are deleted, UWF removes them from the overlay and returns the freed resources to the available pool.

警告和严重事件 Warnings and critical events

当驱动器覆盖填满可用空间时,您可以警告用户磁盘空间不足,并提示用户重新启动设备或运行脚本来清除覆盖区。As the drive overlay fills up the available space, you can warn your users that they're running out of space, and prompt them to reboot the device or to run a script to clear the overlay.

  1. (可选) 设置警告级别和严重级别。Set warning levels and critical levels (optional). 覆盖此值后,UWF 会写入 Windows (ETW) 消息的事件跟踪。When the overlay is filled to this value, UWF writes an Event Tracing for Windows (ETW) message.

    • 警告等级 :默认值 = 512mb。Warning level : Default=512MB. 设置为:Set with:
      • CMDuwfmgr overlay set-warningthresholdCMD: uwfmgr overlay set-warningthreshold
      • CSPNextSession/WarningOverlayThresholdCSP: NextSession/WarningOverlayThreshold
      • WMIUWF\_Overlay.SetWarningThresholdWMI: UWF\_Overlay.SetWarningThreshold
    • 严重级别 :默认值为1024MB。Critical level : Default=1024MB. 设置为:Set with:
      • CMDuwfmgr overlay set-criticalthresholdCMD: uwfmgr overlay set-criticalthreshold
      • CSPNextSession/CriticalOverlayThresholdCSP: NextSession/CriticalOverlayThreshold
      • WMIUWF\_Overlay.SetCriticalThresholdWMI: UWF\_Overlay.SetCriticalThreshold

    请注意,这些设置将在下一次重新启动后生效。Note, these settings will take affect after the next reboot.

  2. 使用任务计划程序来检测 ETW 消息,并警告用户在设备上包装其工作,使其不会在覆盖覆盖之前丢失其内容。Use Task Scheduler to detect the ETW message and to warn users to wrap up their work on the device so they do not lose their content before the overlay is cleared. 还可以提供脚本的链接,以清除覆盖内容。You can also provide a link to script to clear the contents of the overlay.

    创建在 系统 日志接收来自 UWFVOL 的事件 ID 的事件时触发的任务:Create tasks that trigger on the event that the System log receives an event ID from uwfvol :

    覆盖使用情况Overlay usage Source 级别Level 事件 IDEvent ID
    警告阈值Warning threshold uwfvoluwfvol 警告Warning 11
    严重阈值Critical threshold uwfvoluwfvol 错误Error 22
    返回正常Back to normal uwfvoluwfvol 信息Information 33
  3. 重新启动设备。Reboot the device.

在具有磁盘重叠的设备上,可以使用可用空间直通来访问驱动器的更多可用空间。On devices with a disk overlay, you can use freespace passthrough to access your drive's additional free space.

你仍需要在磁盘上保留一些空间用于覆盖。You'll still need to reserve some space on the disk for the overlay. 此空间用于管理覆盖区,并用于存储覆盖,如系统更新。This space is used to manage the overlay, and to store overwrites, such as system updates. 所有其他写入将发送到磁盘上的可用空间。All other writes are sent to free space on disk. 随着时间的推移,保留的重叠速度会变慢且速度更慢,因为覆盖只是不断替换另一个。Over time, the reserved overlay will grow slower and slower, because overwrites will just keep replacing one another.

  • CMD: uwfmgr 覆盖集-传递 (开启 | 关闭) CMD: uwfmgr overlay set-passthrough (on|off)

永久性覆盖 Persistent overlay

备注

此模式为试验性模式,我们建议在将其部署到多台设备之前对其进行彻底的测试。This mode is experimental, and we recommend thoroughly testing it before deploying to multiple devices. 默认情况下,不使用此选项。This option is not used by default.

在具有磁盘覆盖的设备上,你可以选择继续使用覆盖数据,即使在重启后也是如此。On devices with a disk overlay, you can choose to keep working using the overlay data, even after a reboot. 当来宾用户可能需要更长的时间进行访问,可能需要在使用之间关闭设备电源时,这会很有帮助。This can be helpful in situations where your guest users may need to access for longer periods, and may need to power off the device between uses.

此选项可让你的 IT 部门更好地控制覆盖覆盖的时间。This option gives your IT department more control over when the overlay is reset. 你还可以为你的用户提供脚本,这些脚本将帮助用户根据需要重置覆盖区。You can also provide your users with scripts that will help them reset the overlay on demand.

若要打开或关闭永久性覆盖:To turn persistent overlay on or off:

  • CMD: uwfmgr 覆盖集-持久性 (on | off) CMD: uwfmgr overlay set-persistent (on|off)

重置覆盖:To reset the overlay:

  • CMDuwfmgr overlay reset-persistentstate onCMD: uwfmgr overlay reset-persistentstate on

覆盖耗尽Overlay exhaustion

如果覆盖大小接近或等于最大覆盖大小,则任何写入尝试都将失败,并返回一个错误,指示空间不足,无法完成操作。If the size of the overlay is close to or equal to the maximum overlay size, any write attempts will fail, returning an error indicating that there is not enough space to complete the operation. 如果设备上的覆盖达到此状态,则设备可能会停止响应并缓慢,你可能需要重新启动设备。If the overlay on your device reaches this state, your device may become unresponsive and sluggish, and you may need to restart your device.

当 Windows 关闭时,它会尝试将多个文件写入磁盘。When Windows shuts down, it attempts to write a number of files to the disk. 如果覆盖已满,则这些写入尝试将失败,从而导致 Windows 再次尝试重写文件,然后 UWF 才能确定设备正在尝试关闭并解决问题。If the overlay is full, these write attempts fail, causing Windows to attempt to rewrite the files repeatedly until UWF can determine that the device is trying to shut down and resolve the issue. 当覆盖已满或接近满时,尝试使用正常方法关闭会导致设备花费很长时间,在某些情况下,可能会长达一小时或更长时间关闭。Attempting to shut down by using normal methods when the overlay is full or near to full can result in the device taking a long time, in some cases up to an hour or longer, to shut down.

通常可以通过使用 UWF 自动启动关机或重启来避免此问题:You can often avoid this issue by using UWF to automatically initiate the shut down or restart:

  • 关闭Shut down :

    • CMDuwfmgr shutdownCMD: uwfmgr shutdown
    • CSPShutdownSystemCSP: ShutdownSystem
    • WMIUWF\Filter.ShutdownSystemWMI: UWF\Filter.ShutdownSystem
  • 重新启动Restart :

    • CMDuwfmgr restartCMD: uwfmgr restart
    • CSPRestartSystemCSP: RestartSystem
    • WMIUWF\Filter.RestartSystemWMI: UWF\Filter.RestartSystem

统一写入筛选器Unified Write Filter