Unified Write Filter (UWF) not working on Windows 10 Enterprise LTSB RRS feed

  • Question

  • Hi all

    I'm currently trying to migrate my product from Windows Embedded Standard 7 SP1 (WES7) to Windows 10 LTSB (long term servicing branch). I'm having a major problem with the write protection layer in Win10 LTSB that I'm hoping someone can help with (I think it is a bug but perhaps I'm doing something wrong).

    Note that I have tried both Windows 10 LTSB 2015 and Windows 10 LTSB 2016. I have applied all Windows updates and the Unified Write Filter feature is enabled.

    Question 1:

    In WES7, the write protection was known as File Based Write Filter (FBWF). I used this to lock down the operating system but allow write access to a data folder on the same disk volume as my application collects and buffers data in real time - ready to be copied across the network at a later time. This worked fine.

    In Win10LTSB, I can't get the write protection (known as Unified Write Filter - UWF) working reliably. I've set up the UWF to protect the C: drive as I did with WES7. I've also set it up to exclude a folder from the write protection layer (lets call it C:\Excluded). When I create files/data in this \Excluded folder, they are correctly stored on the disk (as the folder is excluded from the write protection layer) and are still present after a reboot - as they should be. So far, this all works correctly.

    The problem is that as files are being stored correctly in this folder, the size of the RAM (or disk) overlay reduces by the same amount. After a few minutes of successfully storing data in this excluded folder, the write protection overlay fills up and the PC grinds to a halt.

    In WES7, files created in an excluded folder did not affect the size of the overlay at all - which is correct. In Win10LTSB, files created in the excluded folder cause the size of the available overlay (RAM or disk) to reduce to the point where the PC will fall over. 

    Does anyone have any experience in this area? Have I done something wrong or is this a bug? As it stands, I won't be able to migrate from WES7 to Win10LTSB for my product until this is resolved as I need to collect data dynamically into a folder that is excluded from the write protection layer.

    Question 2:

    With WES7, I was able to see which files had been diverted to the RAM overlay using the command \Fbfwmgr.exe /overlaydetail

    This permitted me to find out which files were consuming the RAM overlay and add those filenames/locations to the exclusion list as necessary. I can't find any way of looking at the files/folders that are currently consuming the RAM/disk overlay of the Win10LTSB unified write filter.

    Can anyone help?

    Tuesday, September 6, 2016 12:39 PM

All replies

  • Hello Plob,

    LTSB should have the same core as Windows 10 Enterprise (  Have you looked for this issue in the Windows 10 forums or attempted the repro on a desktop running Enterprise?  Do you get the same behavior?

    Sincere thanks,


    Tuesday, September 6, 2016 3:51 PM
  • Hi,

    I had the same problem, to fix it I changed the overlay from RAM to DISK and I make sure that the overlay size was bigger than the free space on the system drive. 

    Tuesday, September 26, 2017 10:01 PM
  • Same issue here!

    Please fix Microsoft.

    In this state we can not use UWF!

    Friday, January 19, 2018 1:36 PM
  • Please use the Windows Feedback app and provide specifics for your repro.  This will get you issue logged into the Windows work item database and reviewed by the team that owns this area.
    Monday, January 22, 2018 6:17 PM
  • This is a function of how UWF works.

    It is just as broken in W8.1 and as there is no W10 *embedded* forum that is the best place to use for questions like this. It is entirely clear that IOT people don't like us Embedded people at all.

    The solution is to move all your big writers to an unprotected partition and only use UWF to protect the OS.

    The commands you need to see how much you are losing are: uwfmgr overlay get-consumption

    In WES8 there used to be a command like get-files. which would give you a list of meaningless garbage where anything had touched a timestamp.

    Now you have to use powershell to see. I have a dumb sample for anyone who is interested.


    Thursday, January 25, 2018 5:46 AM
  • That is correct, UWF was architected this way. I put the overlay consumption call in my UWF utility: 

    For the record, I did find file size limitations with FBWF write-through sections, but this was a rare occurrence. 

    BTW - this forum is for Windows 10 IoT Enterprise as well as IoT Core.

    Sean Liming - Book Author: Starter Guide Windows 10 IoT Enterprise - /

    Thursday, January 25, 2018 3:55 PM