整合寫入篩選器 (UWF) 重迭位置和大小Unified Write Filter (UWF) overlay location and size

(UWF) 的整合寫入篩選器會攔截受保護磁片區的寫入嘗試,並將這些寫入嘗試重新導向至虛擬重迭,藉此保護磁片區的內容。The Unified Write Filter (UWF) protects the contents of a volume by intercepting write attempts to a protected volume and redirects those write attempts to a virtual overlay.

您可以選擇將覆迭儲存 (RAM 或磁片) 、保留的空間大小,以及重迭填滿時,會發生什麼事。You can choose where the overlay is stored (RAM or disk), how much space is reserved, and what happens when the overlay fills up.

若要增加執行時間,請設定監視以檢查您的重迭是否填滿。To increase uptime, set up monitoring to check if your overlay is filling up. 在特定層級,您的裝置可以警告使用者及/或重新開機裝置。At certain levels, your device can warn users and/or reboot the device.

RAM 重迭與磁片重迭RAM overlay vs. disk overlay

  • Ram 重迭 (預設) :虛擬覆迭儲存在 RAM 中,並在重新開機後清除。RAM overlay (default) : The virtual overlay is stored in RAM, and is cleared after a reboot.

    • 藉由寫入 RAM,您可以減少對寫入敏感媒體(如固態硬碟)的磨損。By writing to RAM, you can reduce the wear on write-sensitive media like solid-state drives.
    • RAM 通常比磁片磁碟機空間更受限制。RAM is often more limited than drive space. 當磁片磁碟機重迭填滿可用的 RAM 時,裝置效能可能會降低,而且最終會提示使用者重新開機裝置。As the drive overlay fills up the available RAM, device performance could be reduced, and users will eventually be prompted to reboot the device. 如果您的使用者預期會對重迭進行許多大型寫入,請考慮改為使用磁片重迭。If your users are expected to make many large writes to the overlay, consider using a disk overlay instead.
  • 磁片 重迭:虛擬覆蓋會儲存在磁片磁碟機上的暫存位置。Disk overlay : The virtual overlay is stored in a temporary location on the drive. 根據預設,重新開機時會清除覆迭。By default, the overlay is cleared on reboot.

    • 您可以使用 空間傳遞 來使用磁片磁碟機上的額外可用空間,超過保留的虛擬覆蓋空間。You can use freespace passthrough to use additional free space on the drive beyond the reserved virtual overlay space.
    • 在 Windows 10 的1803版中,您可以使用 持續 重迭,讓使用者即使在重新開機後,也能在虛擬重迭中儲存工作。On Windows 10, version 1803, you can use persistent overlay to allow users to save work in the virtual overlay even after a reboot.

重迭大小Overlay size

  • 預設值 = 1024MB。Default=1024MB. 設定為:Set with:
    • CMDuwfmgr overlay set-sizeCMD: uwfmgr overlay set-size
    • CSPNextSession/MaximumOverlaySizeCSP: NextSession/MaximumOverlaySize
    • WMIUWF\Overlay.SetMaximumSizeWMI: UWF\Overlay.SetMaximumSize

當您規劃裝置的部署時,建議您將重迭大小優化以符合您的需求。When planning device rollouts, we recommend optimizing the overlay size to fit your needs.

針對 RAM 重迭,您必須為系統的某些 RAM 編制預算。For RAM overlays, you'll need to budget some RAM for the system. 例如,如果作業系統需要 2 GB 的 RAM,而您的裝置具有 4 GB 的 RAM,請將覆迭的大小上限設定為 2048MB (2 GB) 或更少。For example, if the OS requires 2 GB of RAM, and your device has 4 GB of RAM, set the maximum size of the overlay to 2048MB (2 GB) or less.

建議您在測試裝置上啟用 UWF、安裝必要的應用程式,以及透過使用方式模擬來放置裝置。We recommend enabling UWF on a test device, installing the necessary apps, and putting the device through usage simulations. 您可以使用此 Powershell 腳本找出哪些檔案耗用空間:You can use this Powershell script to find out which files are consuming space:

$wmiobject = get-wmiobject -Namespace "root\standardcimv2\embedded" -Class UWF_Overlay 
$files = $wmiobject.GetOverlayFiles("c:") 
$files.OverlayFiles | select-object -Property FileName,FileSize  | export-csv -Path D:\output.csv 

使用的重迭數量將取決於:The amount of overlay used will depend on:

  • 裝置使用模式。Device usage patterns.
  • 可以存取的應用程式。Apps that can be accessed. (部分應用程式具有大量寫入磁片區,而且會更快填滿重迭。 ) (Some apps have high write volumes and will fill up the overlay faster.)
  • 重設之間的時間。Time between resets.
  • 當刪除檔案時,UWF 會將其從覆迭中移除,並將釋出的資源傳回至可用的集區。When files are deleted, UWF removes them from the overlay and returns the freed resources to the available pool.

警告和重大事件 Warnings and critical events

當磁片磁碟機重迭填滿可用的空間時,您可以警告使用者它們的空間即將用盡,並提示他們將裝置重新開機,或執行腳本來清除重迭。As the drive overlay fills up the available space, you can warn your users that they're running out of space, and prompt them to reboot the device or to run a script to clear the overlay.

  1. 設定警告層級和關鍵層級 (選擇性) 。Set warning levels and critical levels (optional). 當覆寫填滿此值時,UWF 會寫入 Windows 的事件追蹤 (ETW) 訊息。When the overlay is filled to this value, UWF writes an Event Tracing for Windows (ETW) message.

    • 警告層級 :預設值 = 512mb。Warning level : Default=512MB. 設定為:Set with:
      • CMDuwfmgr overlay set-warningthresholdCMD: uwfmgr overlay set-warningthreshold
      • CSPNextSession/WarningOverlayThresholdCSP: NextSession/WarningOverlayThreshold
      • WMIUWF\_Overlay.SetWarningThresholdWMI: UWF\_Overlay.SetWarningThreshold
    • 重大層級 :預設 = 1024MB。Critical level : Default=1024MB. 設定為:Set with:
      • CMDuwfmgr overlay set-criticalthresholdCMD: uwfmgr overlay set-criticalthreshold
      • CSPNextSession/CriticalOverlayThresholdCSP: NextSession/CriticalOverlayThreshold
      • WMIUWF\_Overlay.SetCriticalThresholdWMI: UWF\_Overlay.SetCriticalThreshold

    請注意,這些設定將會在下次重新開機之後生效。Note, these settings will take affect after the next reboot.

  2. 使用工作排程器來偵測 ETW 訊息,並警告使用者在裝置上包裝其工作,讓他們不會在清除覆迭之前遺失其內容。Use Task Scheduler to detect the ETW message and to warn users to wrap up their work on the device so they do not lose their content before the overlay is cleared. 您也可以提供腳本的連結,以清除覆迭的內容。You can also provide a link to script to clear the contents of the overlay.

    建立當 系統 記錄從 UWFVOL 接收事件識別碼時觸發的工作:Create tasks that trigger on the event that the System log receives an event ID from uwfvol :

    重迭使用量Overlay usage 來源Source 層級Level 事件識別碼Event ID
    警告臨界值Warning threshold uwfvoluwfvol 警告Warning 11
    重大臨界值Critical threshold uwfvoluwfvol 錯誤Error 22
    回到正常Back to normal uwfvoluwfvol 資訊Information 33
  3. 將裝置重新開機。Reboot the device.

在使用磁碟重疊的裝置上,您可以使用可用空間傳遞來存取您磁碟機的額外可用空間。On devices with a disk overlay, you can use freespace passthrough to access your drive's additional free space.

您仍然需要在磁片上保留一些空間以進行覆迭。You'll still need to reserve some space on the disk for the overlay. 此空間可用來管理覆迭,以及儲存覆寫,例如系統更新。This space is used to manage the overlay, and to store overwrites, such as system updates. 所有其他寫入都會傳送至磁片上的可用空間。All other writes are sent to free space on disk. 經過一段時間後,保留的重迭將會變慢且更慢,因為覆寫只會將彼此取代。Over time, the reserved overlay will grow slower and slower, because overwrites will just keep replacing one another.

  • CMD: uwfmgr 重迭集 (開啟 | 關閉) CMD: uwfmgr overlay set-passthrough (on|off)

持續重迭 Persistent overlay


此模式是實驗性,建議您在部署到多個裝置之前徹底進行測試。This mode is experimental, and we recommend thoroughly testing it before deploying to multiple devices. 預設不會使用此選項。This option is not used by default.

在具有磁片重迭的裝置上,即使在重新開機後,您也可以選擇使用重迭資料繼續運作。On devices with a disk overlay, you can choose to keep working using the overlay data, even after a reboot. 當來賓使用者可能需要更長的時間來存取,而且可能需要在使用之間關閉裝置電源時,這會很有説明。This can be helpful in situations where your guest users may need to access for longer periods, and may need to power off the device between uses.

此選項可讓您的 IT 部門更能控制重迭重迭的時間。This option gives your IT department more control over when the overlay is reset. 您也可以為您的使用者提供腳本,以協助他們視需要重設重迭。You can also provide your users with scripts that will help them reset the overlay on demand.

若要開啟或關閉持續覆迭:To turn persistent overlay on or off:

  • CMD: uwfmgr 重迭集-持續 (on | off) CMD: uwfmgr overlay set-persistent (on|off)

若要重設覆迭:To reset the overlay:

  • CMDuwfmgr overlay reset-persistentstate onCMD: uwfmgr overlay reset-persistentstate on

重迭耗盡Overlay exhaustion

如果覆迭的大小接近或等於最大重迭大小,則任何寫入嘗試都會失敗,並傳回錯誤,指出沒有足夠的空間可完成作業。If the size of the overlay is close to or equal to the maximum overlay size, any write attempts will fail, returning an error indicating that there is not enough space to complete the operation. 如果裝置上的重迭達到此狀態,您的裝置可能會變得沒有回應,而且您可能需要重新開機裝置。If the overlay on your device reaches this state, your device may become unresponsive and sluggish, and you may need to restart your device.

當 Windows 關閉時,它會嘗試將數個檔案寫入磁片。When Windows shuts down, it attempts to write a number of files to the disk. 如果覆迭已滿,則這些寫入嘗試將會失敗,導致 Windows 嘗試重複重寫檔案,直到 UWF 判斷裝置正在嘗試關閉並解決問題為止。If the overlay is full, these write attempts fail, causing Windows to attempt to rewrite the files repeatedly until UWF can determine that the device is trying to shut down and resolve the issue. 當覆寫已滿或接近 full 時,若嘗試使用一般方法來關閉,可能會導致裝置花很長的時間(在某些情況下,可能需要一小時或更長的時間才能關閉)。Attempting to shut down by using normal methods when the overlay is full or near to full can result in the device taking a long time, in some cases up to an hour or longer, to shut down.

您通常可以使用 UWF 自動起始關機或重新開機,以避免此問題:You can often avoid this issue by using UWF to automatically initiate the shut down or restart:

  • 關機Shut down :

    • CMDuwfmgr shutdownCMD: uwfmgr shutdown
    • CSPShutdownSystemCSP: ShutdownSystem
    • WMIUWF\Filter.ShutdownSystemWMI: UWF\Filter.ShutdownSystem
  • 重新開機Restart :

    • CMDuwfmgr restartCMD: uwfmgr restart
    • CSPRestartSystemCSP: RestartSystem
    • WMIUWF\Filter.RestartSystemWMI: UWF\Filter.RestartSystem

統一寫入篩選器Unified Write Filter