locked
EWF function enabled failed after WES7 image deployed to another new PC RRS feed

  • Question

  • Build one WES7 image on a computer and EWF(RamReg) is started OK, the EWF enabled normal on C DISK ; but the ghost image was installed to another PC, I found that the EWF failed to enalbe.

    Use "EWFmgr c:", prompted: getting protected volume configuration failed with error 1 function is not correct. This is what happened, please give some advice, thank you.

    Now, I learned that the ghost image deployed in the new PC machine, "DiskSignature" value in the registry is not the value of the new PC,why not get current PC's value automatically; if I modified the "DiskSignature" value to the current PC manually, the EWF will be enabled normally.

    Because I will depoly EWF image to many new PC,I want to EWF can be Enabled automatically. 

    Sorry,my English is poor:),  Thank you very much.



    • Edited by helloxpe Monday, January 18, 2016 2:59 PM add detail info
    Monday, January 18, 2016 2:54 PM

Answers

  • Try "ewfcfg.exe /install-configuration", maybe this will help.

    • Marked as answer by helloxpe Wednesday, January 20, 2016 1:21 PM
    Tuesday, January 19, 2016 9:59 AM
  • You either need to pre-ocnifugre the protected volumes in ICE (Packates -> Embedded Enabling Features -> Enhanced Write Filter with HORM -> Specialize pass (4) -> ProtectedVolumes).

    Alternative: The EWF settings are stored in the registry in the HKLM\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\VolumeX. Once you've performed the ewfcfg.exe utility, run a REG ADD Command to disable EWF for the desired volume (I assume D: applies t o Volume1:

    REG ADD HKLM\SYSTEM\CurrentControlSet\Ewf\Parameters\Protected\Volume1 /v Enabled /t REG_DWORD /v 0 /f

    • Marked as answer by helloxpe Wednesday, January 20, 2016 1:21 PM
    Wednesday, January 20, 2016 9:41 AM
  • Assuming that EWF is in the failed state as described in the inital post, I'm notsure if

    ewfcfg.exe /install-configuration
    ewfmgr.exe d: -disable

    work immediately without rebooting between the two commands. You can try to do so, but if this does not work, you may prefer to

    ewfcfg.exe /install-configuration
    reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Ewf\Parameters\Protected\Volume1 /v Enabled /t REG_DWORD /v 0 /f
    This seems to be a more reliable solution.

    • Marked as answer by helloxpe Wednesday, January 20, 2016 3:10 PM
    Wednesday, January 20, 2016 2:35 PM

All replies

  • You have to run sysprep to create a master image that can be deployed to several systems. When you run sysprep, the EWF volume gets rolled back. The EWF volume will get recreated on each clone. This means EWF must be disabled when you run sysprep, and a sysprep unattended file can be used to re-enable EWF on each clone using pass 7 synchronous commands.

    Sean Liming - Book Author: Starter Guide SIM (WEI), Pro Guide to WE8S & WES 7, Pro Guide to POS for .NET - www.annabooks.com / www.seanliming.com

    Monday, January 18, 2016 5:33 PM
  • Thanks for your replies,
    I have tried to sysprep.exe(sysprep /generalize /oobe /reboot),but EWF can not enabled on another PC。
    the tried steps:
    1.Disable EWF function;
    2.Execute: sysprep /generalize /oobe /reboot;
    3.Ghost this image
    4.Install the ghost image to another PC;
    5.EWF can not be enabled on another PC.

    I want to deploy the image by ghost tool(WES2009 is OK)。
    If I did not add some components?

    I need your help, Thank you very much!

    Tuesday, January 19, 2016 1:51 AM
  • Try "ewfcfg.exe /install-configuration", maybe this will help.

    • Marked as answer by helloxpe Wednesday, January 20, 2016 1:21 PM
    Tuesday, January 19, 2016 9:59 AM
  • Thank Willi K! Thank you! 

    Very good, but it configed EWF successfully to C and D disc (EWF is disable), but I just need to C drive to the EWF, I worry about D disk EWF would affect the stability of the system.

    I would like to know that image does not contain the EWF component, and contains the EWF component but EWF is disable when the system stability is the same?

    Thank you:)


    • Edited by helloxpe Wednesday, January 20, 2016 6:47 AM
    Wednesday, January 20, 2016 6:46 AM
  • You either need to pre-ocnifugre the protected volumes in ICE (Packates -> Embedded Enabling Features -> Enhanced Write Filter with HORM -> Specialize pass (4) -> ProtectedVolumes).

    Alternative: The EWF settings are stored in the registry in the HKLM\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\VolumeX. Once you've performed the ewfcfg.exe utility, run a REG ADD Command to disable EWF for the desired volume (I assume D: applies t o Volume1:

    REG ADD HKLM\SYSTEM\CurrentControlSet\Ewf\Parameters\Protected\Volume1 /v Enabled /t REG_DWORD /v 0 /f

    • Marked as answer by helloxpe Wednesday, January 20, 2016 1:21 PM
    Wednesday, January 20, 2016 9:41 AM
  • The usual reason for EWF blowing a gasket is that tbe diskid changed.

    You should get a warning popup when EWF can't do its stuff.

    Above on step 2, you have /reboot, if it reboots there, it would run the first boot and specialize for that box, including the disk id.

    quick check for disk ID, registry as per "Willi K"

    diskid 

    diskpart

    sel disk 0

    det disk


    =^x^=

    Wednesday, January 20, 2016 11:28 AM
  • Thanks,I  disabled EWF on “D:” by "ewfmgr d: -disable" :)

    --------------------------------------------------------------------------

    You either need to pre-ocnifugre the protected volumes in ICE (Packates -> Embedded Enabling Features -> Enhanced Write Filter with HORM -> Specialize pass (4) -> ProtectedVolumes).

    Alternative: The EWF settings are stored in the registry in the HKLM\SYSTEM\CurrentControlSet\Services\EWF\Parameters\Protected\VolumeX. Once you've performed the ewfcfg.exe utility, run a REG ADD Command to disable EWF for the desired volume (I assume D: applies t o Volume1:

    REG ADD HKLM\SYSTEM\CurrentControlSet\Ewf\Parameters\Protected\Volume1 /v Enabled /t REG_DWORD /v 0 /f


    Wednesday, January 20, 2016 1:24 PM
  • Thank you for your applies,  If I delete "reboot" from step2, it will OK?

    ------------------------------------------------

    The usual reason for EWF blowing a gasket is that tbe diskid changed.

    You should get a warning popup when EWF can't do its stuff.

    Above on step 2, you have /reboot, if it reboots there, it would run the first boot and specialize for that box, including the disk id.

    quick check for disk ID, registry as per "Willi K"

    diskid 

    diskpart

    sel disk 0

    det disk


    =^x^=



    Wednesday, January 20, 2016 1:27 PM
  • Assuming that EWF is in the failed state as described in the inital post, I'm notsure if

    ewfcfg.exe /install-configuration
    ewfmgr.exe d: -disable

    work immediately without rebooting between the two commands. You can try to do so, but if this does not work, you may prefer to

    ewfcfg.exe /install-configuration
    reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Ewf\Parameters\Protected\Volume1 /v Enabled /t REG_DWORD /v 0 /f
    This seems to be a more reliable solution.

    • Marked as answer by helloxpe Wednesday, January 20, 2016 3:10 PM
    Wednesday, January 20, 2016 2:35 PM
  • Assuming that EWF is in the failed state as described in the inital post, I'm notsure if

    ewfcfg.exe /install-configuration
    ewfmgr.exe d: -disable

    work immediately without rebooting between the two commands. You can try to do so, but if this does not work, you may prefer to

    ewfcfg.exe /install-configuration
    reg.exe ADD HKLM\SYSTEM\CurrentControlSet\Ewf\Parameters\Protected\Volume1 /v Enabled /t REG_DWORD /v 0 /f
    This seems to be a more reliable solution.

         I see,thank you:)
    • Marked as answer by helloxpe Wednesday, January 20, 2016 3:10 PM
    • Unmarked as answer by helloxpe Wednesday, January 20, 2016 3:10 PM
    Wednesday, January 20, 2016 3:10 PM